GitHub Advisoryadvisory · crates.io

GHSA-pmcv-mgcf-rvxg Non-aligned u32 read in Chacha20 encryption and decryption

HIGH Published 2022-06-16 Modified 2022-06-16 Official page ↗
Ecosystem
crates.io
Packages
crypto2
Severity
High
Reviewed
2022-06-16

Affected packages

• crates.io crypto2: <= 0.1.2 (no fix yet)

Description

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to `std::slice::from_raw_parts_mut`, which breaks the contract and introduces undefined behavior. This affects Chacha20 encryption and decryption in crypto2.

References