GHSA-66fw-43h8-f8p3 XMP Toolkit's `XmpFile::close` can trigger undefined behavior
An attacker can cause a process abort via undefined behavior in XmpFile::close, requiring an upgrade to the Rust xmp_toolkit library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-66fw-43h8-f8p3?
GHSA-66fw-43h8-f8p3 is a denial of service vulnerability in xmp_toolkit, published on 26 Jul 2024.
Official description
Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occurred, it would trigger undefined behavior, typically a process abort.
This is best demonstrated in issue #230, where a race condition causes the close call to fail due to file I/O errors.
This was fixed in PR #232 (released as crate version 1.9.0), which now safely handles the exception.
For backward compatibility, the existing API ignores the error. A new API XmpFile::try_close was added to allow callers to receive and process the error result.
Users of all prior versions of xmp_toolkit are encouraged to update to version 1.9.0 to avoid undefined behavior.
Which versions are affected by GHSA-66fw-43h8-f8p3?
3 open source packages ship an affected version, including xmp_toolkit.
| Package | Affected | Fixed in |
|---|---|---|
xmp_toolkit crates.io | All versions | 1.9.0 |
xmp_toolkit crates.io | All versions | 1.9.0 |
xmp_toolkit crates.io | From 0.0.0-0 | 1.9.0 |
How do I fix GHSA-66fw-43h8-f8p3?
Upgrade xmp_toolkit to 1.9.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-66fw-43h8-f8p3 being exploited?
There is no known exploitation of GHSA-66fw-43h8-f8p3 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0360.