GHSA-2rxc-gjrp-vjhx Unsoundness in anstream
An unsoundness in the anstream library allows attackers to cause memory corruption or crashes by providing specific UTF-8 strings, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2rxc-gjrp-vjhx?
GHSA-2rxc-gjrp-vjhx is a memory corruption vulnerability in anstream, published on 8 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When given a valid UTF8 string "ö\x1b😀", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \xc3\xb6 then \x1b then \xf0\x9f\x98\x80.
When looping over "non-printable bytes" \x1b\xf0 will be considered as some non-printable sequence.
This will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.
Full credit goes to @Ralith who reviewed this code and asked @burakemir to follow up.
Which versions are affected by GHSA-2rxc-gjrp-vjhx?
3 open source packages ship an affected version, including anstream.
| Package | Affected | Fixed in |
|---|---|---|
anstream crates.io | All versions | 0.6.8 |
anstream crates.io | All versions | 0.6.8 |
anstream crates.io | From 0.0.0-0 | 0.6.8 |
How do I fix GHSA-2rxc-gjrp-vjhx?
Upgrade anstream to 0.6.8 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-2rxc-gjrp-vjhx being exploited?
There is no known exploitation of GHSA-2rxc-gjrp-vjhx in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0404.