wwylele/byte-struct-rs · Security
Deserializing an array can free uninitialized memory in byte_struct
- GHSA ID
- GHSA-8fgg-5v78-6g76
- CVE ID
- CVE-2021-28033
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Byte_struct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.
CWEs
- CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-908 · Use of Uninitialized Resource