GHSA-jcr6-4frq-9gjj Users vulnerable to unaligned read of `*const *const c_char` pointer
An unaligned pointer dereference in the users crate causes undefined behavior, potentially leading to application crashes or panics.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-jcr6-4frq-9gjj?
GHSA-jcr6-4frq-9gjj is a memory corruption vulnerability in users, published on 10 Sep 2023.
Official description
Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior.
In some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in some other way, including the possibility of working correctly in some architectures.
The crate is not currently maintained, so a patched version is not available.
Recommended alternatives
Which versions are affected by GHSA-jcr6-4frq-9gjj?
3 open source packages ship an affected version, including users.
| Package | Affected | Fixed in |
|---|---|---|
users crates.io | All versions to 0.11.0 | None |
users crates.io | All versions to 0.11.0 | None |
users crates.io | From 0.0.0-0 | None |
How do I fix GHSA-jcr6-4frq-9gjj?
No fix has been published for GHSA-jcr6-4frq-9gjj yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-jcr6-4frq-9gjj being exploited?
There is no known exploitation of GHSA-jcr6-4frq-9gjj in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0059.