CRITICAL9.8

GHSA-69fv-gw6g-8ccg

Potential memory corruption in arrayfire

Quick fix

GHSA-69fv-gw6g-8ccg — arrayfire: upgrade to the fixed version with the command below.

pip install --upgrade 'arrayfire>=3.6.0'

Details

The attribute repr() added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain.

arrayfire crates <= version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28.

The issue seems to be interlinked with which version of Rust is being used.

The issue was fixed in crate 3.6.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/arrayfire

Introduced in: 0Fixed in: 3.6.0

Upgrade arrayfire to 3.6.0 or newer (ecosystem crates.io).

PyPI/arrayfire

Introduced in: 0Fixed in: 3.6.0

Fixpip install --upgrade 'arrayfire>=3.6.0'

References

https://nvd.nist.gov/vuln/detail/CVE-2018-20998[ADVISORY]
https://github.com/arrayfire/arrayfire-rust/pull/177[WEB]
https://github.com/arrayfire/arrayfire-rust/commit/a5256f3e5e23b83eaad69699e0b04653aba04fb8[WEB]
https://github.com/arrayfire/arrayfire-rust[PACKAGE]
https://github.com/pypa/advisory-database/tree/main/vulns/arrayfire/PYSEC-2019-144.yaml[WEB]
https://rustsec.org/advisories/RUSTSEC-2018-0011.html[WEB]