Low, CVSS 2.0crates.ioPublished
diesel-async may expose uninitialized padding bytes for MySQL temporal columns
GHSA-ff9q-rm55-q7qr
- Affected
- crates.io diesel-async >= 0.1.0, < 0.9.0
- Fixed in
- 0.9.0· Vendor fix available
- Issue
- diesel-async exposes uninitialized stack padding to safe code on every read of a MySQL DATE, TIME, DATETIME, or TIMESTAMP column. Reading that buffer is undefined behavior, and the leaked bytes can contain stale heap/stack contents, so this is both a soundness bug and a potential information-disclosure vector. Details In diesel-async/src/mysql/row.rs (lines 65-103), MysqlRow::get builds a MysqlTime from the parsed mysqlasync::Value and then fabricates the byte buffer that downstream FromSql impls expect like this: MysqlTime is #[repr(C)] with 3 bytes of padding after bool neg (Linux x8664, offsets 0x21..0x23). The literal construction leaves that padding uninitialized, and tovec() carries it into a Vec<u8 that becomes the MysqlValue's backing buffer, reachable from safe code via MysqlValue::asbytes() - &[u8]. diesel itself avoids this by going through MaybeUninit::<MysqlTime::zeroed() + ptr::copynonoverlapping (see diesel/src/mysql/value.rs:43-94); the same pattern would fix…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.