GHSA-gch5-hwqf-mxhp Unsoundness in `intern` methods on `intaglio` symbol interners
Unsoundness in intaglio symbol interners allows memory corruption via stacked borrows violations, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-gch5-hwqf-mxhp?
GHSA-gch5-hwqf-mxhp is a memory corruption vulnerability in intaglio, published on 26 Jul 2023.
Official description
Affected versions of this crate have a stacked borrows violation when creating references to interned contents. All interner types are affected.
The flaw was corrected in version 1.9.0 by reordering move and borrowing
operations and storing interned contents by raw pointer instead of as a Box.
Which versions are affected by GHSA-gch5-hwqf-mxhp?
3 open source packages ship an affected version, including intaglio.
| Package | Affected | Fixed in |
|---|---|---|
intaglio crates.io | All versions | 1.9.0 |
intaglio crates.io | All versions | 1.9.0 |
intaglio crates.io | From 0.0.0-0 | 1.9.0 |
How do I fix GHSA-gch5-hwqf-mxhp?
Upgrade intaglio to 1.9.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-gch5-hwqf-mxhp being exploited?
There is no known exploitation of GHSA-gch5-hwqf-mxhp in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0048.