GHSA-jwh2-vrr9-vcp2 mz-avro's incorrect use of `set_len` allows for un-initialized memory
Attackers can exploit unidiomatic Read implementations to expose uninitialized memory or cause undefined behavior in applications using the mz-avro crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-jwh2-vrr9-vcp2?
GHSA-jwh2-vrr9-vcp2 is a memory corruption vulnerability in mz-avro, published on 14 Oct 2021.
Official description
Affected versions of this crate passes an uninitialized buffer to a user-provided Read
implementation.
Arbitrary Read implementations can read from the uninitialized buffer (memory exposure)
and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke
undefined behavior.
Note: there is only UB in the case where a user provides a struct whose Read
implementation inspects the buffer passed to read_exact before writing to it.
This is an unidiomatic (albeit possible) Read implementation.
See https://github.com/MaterializeInc/materialize/issues/8669 for details.
Which versions are affected by GHSA-jwh2-vrr9-vcp2?
3 open source packages ship an affected version, including mz-avro.
| Package | Affected | Fixed in |
|---|---|---|
mz-avro crates.io | All versions | 0.7.0 |
mz-avro crates.io | All versions | 0.7.0 |
mz-avro crates.io | From 0.0.0-0 | 0.7.0 |
How do I fix GHSA-jwh2-vrr9-vcp2?
Upgrade mz-avro to 0.7.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-jwh2-vrr9-vcp2 being exploited?
There is no known exploitation of GHSA-jwh2-vrr9-vcp2 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2021-0138.