GitHub Advisoryadvisory · crates.io
GHSA-gwfj-pw2x-h6c2 Out of bounds read in simd-json
HIGH
Official page ↗
- Aliases
- CVE-2019-15550
- Ecosystem
- crates.io
- Packages
- simd-json
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-125
- Reviewed
- 2021-08-19
Affected packages
• crates.io simd-json: >= 0.1.13, < 0.1.15 → fixed in 0.1.15
Description
The affected version of this crate did not guard against accessing memory beyond the range of its input data. A pointer cast to read the data into a 256-bit register could lead to a segmentation fault when the end plus the 32 bytes (256 bit) read would overlap into the next page during string parsing. This allows an attacker to eventually crash a service. The flaw was corrected by using a padding buffer for the last read from the input. So that we are we never read over the boundary of the input data.
Related
Alias · CVE (1)
- CVE-2019-15550 An issue was discovered in the simd-json crate before 0.1.15 for Rust. vulnerability
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness