CVE-2021-38188 Incorrect buffer size calculation in iced-x86
An unsafe memory access in the iced-x86 Rust crate can cause a panic or crash when decoding malformed instructions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38188?
CVE-2021-38188 is a critical vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new(), slice.get_unchecked(slice.length()) is used unsafely.
Which versions are affected by CVE-2021-38188?
3 open source packages ship an affected version, including iced-x86. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
iced-x86 crates.io | All versions | 1.11.0 |
iced-x86 crates.io | All versions | 1.11.0 |
iced-x86 crates.io | From 0.0.0-0 | 1.10.4-0 |
Products include Iced-X86 Project Iced-X86.
How do I fix CVE-2021-38188?
Upgrade iced-x86 to a fixed version for your release line: 1.11.0 or 1.10.4-0.
Is CVE-2021-38188 being exploited?
There is no known exploitation of CVE-2021-38188 in the wild and no public exploit code.
Sources
Also known as GHSA-jjx5-3f36-6927, RUSTSEC-2021-0068.