GHSA-5m39-wx2q-mxg3 Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`
Use of uninitialized memory in compression functions can lead to crashes or arbitrary code execution when processing malicious data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5m39-wx2q-mxg3?
GHSA-5m39-wx2q-mxg3 is a memory corruption vulnerability in lzf, published on 22 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The compression and decompression function used mem:uninitialized to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory.
The flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf by using a heap-allocated Vec and removing out use of mem::uninitialized. The fix was released in v0.3.2 and v1.0.0
Subsequently, the crate was deprecated and its use is discouraged.
Which versions are affected by GHSA-5m39-wx2q-mxg3?
3 open source packages ship an affected version, including lzf.
| Package | Affected | Fixed in |
|---|---|---|
lzf crates.io | All versions | 0.3.2 |
lzf crates.io | All versions | 0.3.2 |
lzf crates.io | From 0.0.0-0 | 0.3.2 |
How do I fix GHSA-5m39-wx2q-mxg3?
Upgrade lzf to 0.3.2 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-5m39-wx2q-mxg3 being exploited?
There is no known exploitation of GHSA-5m39-wx2q-mxg3 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2022-0067.