Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

vmm-sys-util

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.7crates.ioPublished

    serde deserialization for FamStructWrapper lacks bound checks that could potentially lead to out-of-bounds memory access

    CVE-2023-50711 · GHSA-875g-mfp6-g7f9

    Affected
    • crates.io vmm-sys-util >= 0.5.0, < 0.12.0
    Fixed in
    0.12.0· Vendor fix available
    Issue
    Impact An issue was discovered in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper, which can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array length. Mismatch in the lengths might allow out of bounds memory access through Rust-safe methods. Impacted versions: = 0.5.0 Patches The issue was corrected in version 0.12.0 by inserting a check that verifies the lengths of compared flexible arrays are equal for any deserialized header and aborting deserialization otherwise. Moreover, the API was changed so that header length can only be modified through Rust-unsafe code. This ensures that users cannot trigger out-of-bounds memory access from Rust-safe code.

    Recommended action: Upgrade to 0.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →