GitHub Advisoryadvisory · crates.io

GHSA-g753-ghr7-q33w cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`

MEDIUM Published 2023-06-22 Modified 2023-06-22 Official page ↗

Ecosystem: crates.io
Packages: cyfs-base
Severity: Moderate
Reviewed: 2023-06-22

Affected packages

• crates.io cyfs-base: <= 0.6.12 (no fix yet)

Description

The function `ChunkId::new` creates a misaligned pointer by casting mutable pointer of `u8` slice which has alignment 1 to the mutable pointer of `u32` which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function.

References

https://github.com/buckyos/CYFS/issues/275 web
https://github.com/buckyos/CYFS/commit/e030188895096fd8d91d48753877729f4d37dd24 web
https://github.com/buckyos/CYFS package
https://rustsec.org/advisories/RUSTSEC-2023-0046.html web