elrnv/dync · Security
Out of bounds read in dync
- GHSA ID
- GHSA-qxjq-v4wf-ppvh
- CVE ID
- CVE-2020-35903
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description
VecCopy::data is created as a Vec of u8 but can be used to store and retrieve elements of different types leading to misaligned access.
The issue was resolved in v0.5.0 by replacing data being stored by Vec with a custom managed pointer. Elements are now stored and retrieved using types with proper alignment corresponding to original types.
CWEs
- CWE-125 · Out-of-bounds Read