Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jeDdoLWg4N3ItanBncs4AA-Hz

The kstring integration in gix-attributes is unsound

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

Permalink: https://github.com/advisories/GHSA-cx7h-h87r-jpgr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jeDdoLWg4N3ItanBncs4AA-Hz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 2 months ago
Updated: about 2 months ago

Identifiers: GHSA-cx7h-h87r-jpgr
References:

• https://github.com/Byron/gitoxide/issues/1460
• https://github.com/rustsec/advisory-db/commit/884aaa1646132bc3a27ba058197d6ef039bec294
• https://rustsec.org/advisories/RUSTSEC-2024-0359.html
• https://github.com/advisories/GHSA-cx7h-h87r-jpgr

Repository: https://github.com/Byron/gitoxide
Blast Radius: 0.0

Affected Packages