GitHub Advisoryadvisory · crates.io

GHSA-gwfj-pw2x-h6c2 Out of bounds read in simd-json

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2019-15550
Ecosystem
crates.io
Packages
simd-json
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125
Reviewed
2021-08-19

Affected packages

• crates.io simd-json: >= 0.1.13, < 0.1.15 → fixed in 0.1.15

Description

The affected version of this crate did not guard against accessing memory beyond the range of its input data. A pointer cast to read the data into a 256-bit register could lead to a segmentation fault when the end plus the 32 bytes (256 bit) read would overlap into the next page during string parsing. This allows an attacker to eventually crash a service. The flaw was corrected by using a padding buffer for the last read from the input. So that we are we never read over the boundary of the input data.

Related

Alias · CVE (1)

  • CVE-2019-15550 An issue was discovered in the simd-json crate before 0.1.15 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References