Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh2cWMtcGM3OC14OXdo

Soundness issue in raw-cpuid

VendorInfo::as_string(), SoCVendorBrand::as_string(), and ExtendedFunctionInfo::processor_brand_string() construct byte slices using std::slice::from_raw_parts(), with data coming from #[repr(Rust)] structs. This is always undefined behavior.
This flaw has been fixed in v9.0.0, by making the relevant structs #[repr(C)].

Permalink: https://github.com/advisories/GHSA-hvqc-pc78-x9wh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh2cWMtcGM3OC14OXdo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 11 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-hvqc-pc78-x9wh, CVE-2021-26306
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-26306
• https://github.com/gz/rust-cpuid/issues/40
• https://github.com/RustSec/advisory-db/pull/614
• https://rustsec.org/advisories/RUSTSEC-2021-0013.html
• https://github.com/advisories/GHSA-hvqc-pc78-x9wh

Repository: https://github.com/gz/rust-cpuid
Blast Radius: 25.7

Affected Packages