firecracker-microvm/versionize · Security
Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses
- GHSA ID
- GHSA-8vxc-r5wp-vgvc
- CVE ID
- CVE-2023-28448
- Severity
- medium
- Published
- Updated
- CVSS
- 5.7 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
- CVSS v3
- 5.7 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Description
Impact
An issue was discovered in the Versionize::deserialize implementation provided by the versionize crate for vmm_sys_util::fam::FamStructWrapper, which can lead to out of bounds memory accesses.
Patches
The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
Workarounds
-
References
CWEs
- CWE-125 · Out-of-bounds Read
References
- https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-28448 ↗
- https://github.com/firecracker-microvm/versionize/pull/53 ↗
- https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47 ↗
- https://github.com/firecracker-microvm/versionize/releases/tag/v0.1.10 ↗
- https://rustsec.org/advisories/RUSTSEC-2023-0030.html ↗
- https://github.com/advisories/GHSA-8vxc-r5wp-vgvc ↗