Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1naGM4LTVjZ20tNXJwZs4AA1zP

Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime

Affected versions allow arbitrary caller-provided code to execute before the lifetime of main.

If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are likely; UB is possible.

The flaw was corrected by enforcing that only code written within the inventory crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before main. Caller-provided code is restricted to running at compile time.

Permalink: https://github.com/advisories/GHSA-ghc8-5cgm-5rpf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naGM4LTVjZ20tNXJwZs4AA1zP
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

Identifiers: GHSA-ghc8-5cgm-5rpf
References:

• https://github.com/dtolnay/inventory/pull/43
• https://github.com/dtolnay/inventory/commit/b853350a3800e38d2cb9950355b80bc8b8d3959c
• https://rustsec.org/advisories/RUSTSEC-2023-0057.html
• https://github.com/advisories/GHSA-ghc8-5cgm-5rpf

Repository: https://github.com/dtolnay/inventory
Blast Radius: 0.0

Affected Packages