GitHub Advisoryadvisory · crates.io

GHSA-3jch-9qgp-4844 Generated code can read and write out of bounds in safe code

CRITICAL Published 2022-06-16 Modified 2022-06-16 Official page ↗

Ecosystem: crates.io
Packages: flatbuffers
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed: 2022-06-16

Affected packages

• crates.io flatbuffers: < 22.9.29 → fixed in 22.9.29

Description

Code generated by flatbuffers' compiler is `unsafe` but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by `flatbuffers` compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit their code and look for any usage of `follow`, `push`, or any method that uses them (e.g. `self_follow`). 3. Carefuly go through the crates' documentation to understand which "safe" APIs are not intended to be used.

References

https://github.com/google/flatbuffers/issues/6627 web
https://github.com/google/flatbuffers/pull/7518 web
https://github.com/google/flatbuffers package
https://github.com/google/flatbuffers/releases/tag/v22.9.29 web
https://rustsec.org/advisories/RUSTSEC-2021-0122.html web