GHSA-83gg-pwxf-jr89 `array!` macro is unsound in presence of traits that implement methods it calls internally

Not scored Published 7 May 2020

A Rust library vulnerability allows trait implementations to hijack internal method calls, potentially leading to memory unsoundness and arbitrary code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Not stated
Victim action needed: Not needed
Fix: Available

What is GHSA-83gg-pwxf-jr89?

GHSA-83gg-pwxf-jr89 is a code injection vulnerability in array-macro, published on 7 May 2020.

Official description

Affected versions of this crate called some methods using auto-ref. The affected code looked like this.

let mut arr = $crate::__core::mem::MaybeUninit::uninit();
let mut vec = $crate::__ArrayVec::&lt;T&gt;::new(arr.as_mut_ptr() as *mut T);

In this case, the problem is that as_mut_ptr is a method of &mut MaybeUninit, not MaybeUninit. This made it possible for traits to hijack the method calls in order to cause unsoundness.

trait AsMutPtr&lt;T&gt; {
    fn as_mut_ptr(&amp;self) -&gt; *mut T;
}
impl&lt;T&gt; AsMutPtr&lt;T&gt; for std::mem::MaybeUninit&lt;T&gt; {
    fn as_mut_ptr(&amp;self) -&gt; *mut T {
        std::ptr::null_mut()
    }
}
array![0; 1];

The flaw was corrected by explicitly referencing variables in macro body in order to avoid auto-ref.

Which versions are affected by GHSA-83gg-pwxf-jr89?

3 open source packages ship an affected version, including array-macro.

Package	Affected	Fixed in
`array-macro` crates.io	From `0.1.2`	`1.0.5`
`array-macro` crates.io	From `0.1.2`	`1.0.5`
`array-macro` crates.io	From `0.1.2`	`1.0.5`

How do I fix GHSA-83gg-pwxf-jr89?

Upgrade array-macro to 1.0.5 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is GHSA-83gg-pwxf-jr89 being exploited?

There is no known exploitation of GHSA-83gg-pwxf-jr89 in the wild and no public exploit code.

Sources

Also known as RUSTSEC-2020-0161.