# GHSA-87mf-9wg6-ppf8: Ouroboros is Unsound


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 11 Jun 2023
- **Also known as:** RUSTSEC-2023-0042

## What is GHSA-87mf-9wg6-ppf8?

GHSA-87mf-9wg6-ppf8 is a vulnerability in ouroboros, published on 11 Jun 2023. 

### Official description

## Summary

Ouroboros has a soundness problem, but a fix has been implemented in 0.16.0.

## More details:

In 0.15.0, Ouroboros works internally by creating a struct where all 
uses of 'this are replaced by 'static. However, a recent addition to 
Miri checks that references passed to functions are valid during the 
entire execution of the function, even when those references are 
passed inside a struct. This poses an issue for dropping 
self-referencing values, as the reference becomes invalid during the 
dropping process. Effectively, since self-referencing structs are 
not allowed in vanilla Rust, there is no allowance for dropping data
during a function that has also been given a reference to that data. 
There's usually no way to pass a and &a to the same function.

A fix was attempted, where the struct would be turned in to a raw 
byte array and only transformed back into the underlying data type 
inside each function. This is allowable as a reference can be 
created and die over the body of a function, as long as the 
reference was created inside the function. However, this is also 
not sound if the original struct contains padding. There is no 
way to initialize padding bytes to a known value that Miri will 
accept, so when it is cast to an array some of the bytes contain 
uninitialized values. This is not acceptable (despite the fact 
that these bytes are never read) due to the potential for 
optimizations that may read from the uninitialized bytes. Besides 
which, this fix does not allow for template or constant parameters 
as there is no way to check the size of a templated type without 
giving specific, concrete values for the template parameters.

The final solution was to use this fix while wrapping the raw byte
array in `MaybeUninit<>`.

## Which versions are affected by GHSA-87mf-9wg6-ppf8?

3 open source packages ship an affected version, including ouroboros.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `ouroboros` | crates.io | All versions | 0.16.0 |
| `ouroboros` | crates.io | All versions | 0.16.0 |
| `ouroboros` | crates.io | From 0.0.0-0 | 0.16.0 |

## How do I fix GHSA-87mf-9wg6-ppf8?

Upgrade ouroboros to 0.16.0 or later.

## Is GHSA-87mf-9wg6-ppf8 being exploited?

There is no known exploitation of GHSA-87mf-9wg6-ppf8 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-87mf-9wg6-ppf8 and fix it if it is affected.

What it is: GHSA-87mf-9wg6-ppf8 is a vulnerability in ouroboros, published on 11 Jun 2023. 
Exploitation: There is no known exploitation of GHSA-87mf-9wg6-ppf8 in the wild and no public exploit code.

Affected packages and fixed versions:
- ouroboros (crates.io): affected all versions; fixed in 0.16.0
- ouroboros (crates.io): affected all versions; fixed in 0.16.0
- ouroboros (crates.io): affected from 0.0.0-0; fixed in 0.16.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-87mf-9wg6-ppf8/ (Markdown: https://insights.sbomify.com/GHSA-87mf-9wg6-ppf8/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-87mf-9wg6-ppf8

---
From sbomify Insights: https://insights.sbomify.com/GHSA-87mf-9wg6-ppf8/
Summaries are generated and may contain mistakes; the official description above is the record.