VDB
Sign up
MEDIUM5.7

GHSA-8vxc-r5wp-vgvc

Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses

Details

### Impact

An issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses.

### Patches

The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

### Workarounds \-

### References - https://github.com/firecracker-microvm/versionize/pull/53

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/versionize
Introduced in: 0.1.1Fixed in: 0.1.10

Upgrade versionize to 0.1.10 or newer (ecosystem crates.io).

References