GHSA-cx7h-h87r-jpgr The kstring integration in gix-attributes is unsound
Unsound UTF-8 handling in gix-attributes exposes invalid strings to dependent crates, potentially causing memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-cx7h-h87r-jpgr?
GHSA-cx7h-h87r-jpgr is a memory corruption vulnerability in gix-attributes, published on 24 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:
// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.
The problem is that the non-UTF8 str is exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.
This is not sound, and it could cause further UB down the line in these places that can view the &str.
Thanks to Devin Jeanpierre for discovering and reporting this issue.
Which versions are affected by GHSA-cx7h-h87r-jpgr?
3 open source packages ship an affected version, including gix-attributes.
| Package | Affected | Fixed in |
|---|---|---|
gix-attributes crates.io | All versions | 0.22.3 |
gix-attributes crates.io | All versions | 0.22.3 |
gix-attributes crates.io | From 0.0.0-0 | 0.22.3 |
How do I fix GHSA-cx7h-h87r-jpgr?
Upgrade gix-attributes to 0.22.3 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-cx7h-h87r-jpgr being exploited?
There is no known exploitation of GHSA-cx7h-h87r-jpgr in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0359.