MEDIUM

GHSA-g753-ghr7-q33w

cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`

Details

The function `ChunkId::new` creates a misaligned pointer by casting mutable pointer of `u8` slice which has alignment 1 to the mutable pointer of `u32` which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/cyfs-base

Introduced in: 0

No fixed version published yet for cyfs-base. Pin to a known-safe version or switch to an alternative.

References

https://github.com/buckyos/CYFS/issues/275[WEB]
https://github.com/buckyos/CYFS/commit/e030188895096fd8d91d48753877729f4d37dd24[WEB]
https://github.com/buckyos/CYFS[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2023-0046.html[WEB]