GHSA-2326-pfpj-vx3h lexical-core has multiple soundness issues
Multiple soundness issues in lexical-core allow memory corruption and potential code execution via invalid bit patterns or out-of-bounds iterator access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2326-pfpj-vx3h?
GHSA-2326-pfpj-vx3h is a memory corruption vulnerability in lexical-core, published on 3 Sep 2023.
Official description
RUSTSEC-2024-0377 contains multiple soundness issues:
- Bytes::read() allows creating instances of types with invalid bit patterns
- BytesIter::read() advances iterators out of bounds
- The
BytesItertrait has safety invariants but is public and not markedunsafe write_float()callsMaybeUninit::assume_init()on uninitialized data, which is is not allowed by the Rust abstract machineradix()callsMaybeUninit::assume_init()on uninitialized data, which is is not allowed by the Rust abstract machine
Version 1.0 fixes these issues, removes the vast majority of unsafe code, and also fixes some correctness issues.
Which versions are affected by GHSA-2326-pfpj-vx3h?
3 open source packages ship an affected version, including lexical-core.
| Package | Affected | Fixed in |
|---|---|---|
lexical-core crates.io | All versions | 1.0.0 |
lexical-core crates.io | All versions | 1.0.0 |
lexical-core crates.io | From 0.0.0-0 | 1.0.0 |
How do I fix GHSA-2326-pfpj-vx3h?
Upgrade lexical-core to 1.0.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-2326-pfpj-vx3h being exploited?
There is no known exploitation of GHSA-2326-pfpj-vx3h in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0086.