RUSTSEC-2023-0056

    Dashboard / Vulnerabilities / RUSTSEC-2023-0056

    RUSTSEC-2023-0056

    Published: 1 Sept 2023Last Modified: 8 Nov 2023

    Summary: Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses

    Details: An issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less than the function’s `count` argument. No implementations of `get_slice` provided in `vm_memory` are affected. Users of custom `VolatileMemory` implementations may be impacted if the custom implementation does not adhere to `get_slice`'s documentation. The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returned by `get_slice` is of the correct length.

    References: https://crates.io/crates/vm-memory, https://rustsec.org/advisories/RUSTSEC-2023-0056.html, https://github.com/rust-vmm/vm-memory/issues/250, https://github.com/rust-vmm/vm-memory/commit/aff1dd4a5259f7deba56692840f7a2d9ca34c9c8

    Affected packages

    Package

    Name: vm-memory

    Purl: pkg:cargo/vm-memory

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -0.12.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2023-0056 | CVE-DB