google/flatbuffers · Security
Unsound casting in flatbuffers
- GHSA ID
- GHSA-gx73-2498-r55c
- CVE ID
- CVE-2019-25004
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The implementation of impl Follow for bool allows to reinterpret arbitrary bytes as a bool.
In Rust bool has stringent requirements for its in-memory representation. Use of this function allows to violate these requirements and invoke undefined behaviour in safe code.
CWEs
- CWE-704 · Incorrect Type Conversion or Cast