GHSA-f95p-4cv5-8w8x linkme fails to ensure slice elements match the slice's declared type
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-f95p-4cv5-8w8x?
GHSA-f95p-4cv5-8w8x is a vulnerability in linkme, published on 5 Mar 2024.
Official description
Affected versions allow populating a DistributedSlice of T with elements of an arbitrary other type that coerces to T. For example, elements of type &&str could end up in a slice of type [&str], since &&str coerces to &str via a deref coercion.
The flaw was corrected by implementing typechecking for distributed slice elements in such a way that coercion no longer occurs. The element's type must be a subtype of the slice's declared element type.
Which versions are affected by GHSA-f95p-4cv5-8w8x?
3 open source packages ship an affected version, including linkme.
| Package | Affected | Fixed in |
|---|---|---|
linkme crates.io | All versions | 0.3.24 |
linkme crates.io | All versions | 0.3.24 |
linkme crates.io | From 0.0.0-0 | 0.3.24 |
How do I fix GHSA-f95p-4cv5-8w8x?
Upgrade linkme to 0.3.24 or later.
Is GHSA-f95p-4cv5-8w8x being exploited?
There is no known exploitation of GHSA-f95p-4cv5-8w8x in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0407.