GitHub Advisoryadvisory · crates.io

GHSA-8fgg-5v78-6g76 Deserializing an array can free uninitialized memory in byte_struct

CRITICAL Published 2021-08-25 Modified 2022-05-04 Official page ↗
Aliases
CVE-2021-28033
Ecosystem
crates.io
Packages
byte_struct
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-908
Reviewed
2021-08-19

Affected packages

• crates.io byte_struct: < 0.6.1 → fixed in 0.6.1

Description

Byte_struct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.

Related

Alias · CVE (1)

  • CVE-2021-28033 An issue was discovered in the byte_struct crate before 0.6.1 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-908 Use of Uninitialized Resource weakness

References