GitHub Advisoryadvisory · crates.io

GHSA-hvqc-pc78-x9wh Soundness issue in raw-cpuid

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2021-26306
Ecosystem
crates.io
Packages
raw-cpuid
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-198, CWE-400
Reviewed
2021-08-19

Affected packages

• crates.io raw-cpuid: < 9.0.0 → fixed in 9.0.0

Description

VendorInfo::as_string(), SoCVendorBrand::as_string(), and ExtendedFunctionInfo::processor_brand_string() construct byte slices using std::slice::from_raw_parts(), with data coming from #[repr(Rust)] structs. This is always undefined behavior. This flaw has been fixed in v9.0.0, by making the relevant structs #[repr(C)].

Related

Alias · CVE (1)

  • CVE-2021-26306 An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-198 Use of Incorrect Byte Ordering weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References