GHSA-ghc8-5cgm-5rpf Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
Attackers can execute arbitrary code before main initialization, potentially causing undefined behavior or crashes in Rust applications using the inventory crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-ghc8-5cgm-5rpf?
GHSA-ghc8-5cgm-5rpf is a code injection vulnerability in inventory, published on 10 Sep 2023.
Official description
Affected versions allow arbitrary caller-provided code to execute before the lifetime of main.
If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are likely; UB is possible.
The flaw was corrected by enforcing that only code written within the inventory crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before main. Caller-provided code is restricted to running at compile time.
Which versions are affected by GHSA-ghc8-5cgm-5rpf?
3 open source packages ship an affected version, including inventory.
| Package | Affected | Fixed in |
|---|---|---|
inventory crates.io | All versions | 0.2.0 |
inventory crates.io | All versions | 0.2.0 |
inventory crates.io | From 0.0.0-0 | 0.2.0 |
How do I fix GHSA-ghc8-5cgm-5rpf?
Upgrade inventory to 0.2.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-ghc8-5cgm-5rpf being exploited?
There is no known exploitation of GHSA-ghc8-5cgm-5rpf in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0057.