gz/rust-cpuid · Security

Optional `Deserialize` implementations lacking validation

GHSA ID
GHSA-jf5h-cf95-w759
Severity
medium
Published
Updated

Description

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to:

  • Undefined behavior in as_string() methods (which use std::str::from_utf8_unchecked() internally).
  • Panics due to failed assertions.

See https://github.com/gz/rust-cpuid/issues/43.

References