GHSA-3mv5-343c-w2qg Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMut
Unsound Ref methods in the zerocopy library allow safe code to trigger undefined behavior, potentially leading to memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3mv5-343c-w2qg?
GHSA-3mv5-343c-w2qg is a memory corruption vulnerability in zerocopy, published on 14 Dec 2023.
Official description
This advisory is also published as RUSTSEC-2023-0074.
The Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound and may allow safe code to exhibit undefined behavior when used with Ref<B, T> where B is cell::Ref or cell::RefMut. Note that these methods remain sound when used with B types other than cell::Ref or cell::RefMut.
See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis.
The current plan is to yank the affected versions soon. See https://github.com/google/zerocopy/issues/679 for more detail.
Which versions are affected by GHSA-3mv5-343c-w2qg?
25 open source packages ship an affected version, including zerocopy.
| Package | Affected | Fixed in |
|---|---|---|
zerocopy crates.io | From 0.2.2 | 0.2.9, 0.3.2, 0.4.1, 0.5.2, 0.6.6, 0.7.31 |
zerocopy crates.io | From 0.2.2 | 0.2.9 |
zerocopy crates.io | From 0.2.2 | 0.2.9 |
zerocopy crates.io | From 0.2.2 | 0.2.9 |
zerocopy crates.io | From 0.2.2 | 0.2.9 |
zerocopy crates.io | From 0.3.0 | 0.3.2 |
19 more packages
zerocopy crates.io | From 0.3.0 | 0.3.2 |
zerocopy crates.io | From 0.3.0 | 0.3.2 |
zerocopy crates.io | From 0.3.0 | 0.3.2 |
zerocopy crates.io | From 0.4.0 | 0.4.1 |
zerocopy crates.io | From 0.4.0 | 0.4.1 |
zerocopy crates.io | From 0.4.0 | 0.4.1 |
zerocopy crates.io | From 0.4.0 | 0.4.1 |
zerocopy crates.io | From 0.5.0 | 0.5.2 |
zerocopy crates.io | From 0.5.0 | 0.5.2 |
zerocopy crates.io | From 0.5.0 | 0.5.2 |
zerocopy crates.io | From 0.5.0 | 0.5.2 |
zerocopy crates.io | From 0.6.0 | 0.6.6 |
zerocopy crates.io | From 0.6.0 | 0.6.6 |
zerocopy crates.io | From 0.6.0 | 0.6.6 |
zerocopy crates.io | From 0.6.0 | 0.6.6 |
zerocopy crates.io | From 0.7.0 | 0.7.31 |
zerocopy crates.io | From 0.7.0 | 0.7.31 |
zerocopy crates.io | From 0.7.0 | 0.7.31 |
zerocopy crates.io | From 0.7.0 | 0.7.31 |
How do I fix GHSA-3mv5-343c-w2qg?
Upgrade zerocopy to a fixed version for your release line: 0.2.9, 0.3.2, 0.4.1 or 0.5.2.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-3mv5-343c-w2qg being exploited?
There is no known exploitation of GHSA-3mv5-343c-w2qg in the wild and no public exploit code.
Sources
Also known as GHSA-rjhf-4mh8-9xjq, RUSTSEC-2023-0074.