GitHub Advisoryadvisory · crates.io

GHSA-qxjq-v4wf-ppvh Out of bounds read in dync

MEDIUM Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35903
Ecosystem
crates.io
Packages
dync
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125
Reviewed
2021-08-19

Affected packages

• crates.io dync: < 0.5.0 → fixed in 0.5.0

Description

VecCopy::data is created as a Vec of u8 but can be used to store and retrieve elements of different types leading to misaligned access. The issue was resolved in v0.5.0 by replacing data being stored by Vec with a custom managed pointer. Elements are now stored and retrieved using types with proper alignment corresponding to original types.

Related

Alias · CVE (1)

  • CVE-2020-35903 An issue was discovered in the dync crate before 0.5.0 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References