RUSTSEC-2018-0004

    Dashboard / Vulnerabilities / RUSTSEC-2018-0004

    RUSTSEC-2018-0004

    Published: 25 Aug 2018Last Modified: 8 Nov 2023

    Summary: Malicious input could cause uninitialized memory to be exposed

    Details: Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could be exposed. This allows an attacker to observe parts of the uninitialized memory in the decoded audio stream. The flaw was corrected by checking that the value read from the bitstream divides the decode buffer size, and returning a format error if it does not. If an error is returned, the decode buffer is not exposed. Regression tests and an additional fuzzer have been added to prevent similar flaws in the future.

    References: https://crates.io/crates/claxon, https://rustsec.org/advisories/RUSTSEC-2018-0004.html, https://github.com/ruuda/claxon/commit/8f28ec275e412dd3af4f3cda460605512faf332c

    Affected packages

    Package

    Name: claxon

    Purl: pkg:cargo/claxon

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -0.3.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High