GHSA-pfr9-2p92-qrhq Heap Buffer overflow using c_chars_to_str function
A heap buffer overflow in the DBN library allows attackers to read sensitive memory or cause crashes via malformed input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-pfr9-2p92-qrhq?
GHSA-pfr9-2p92-qrhq is a memory corruption vulnerability in dbn, published on 7 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The heap-buffer-overflow is triggered in the strlen() function when handling the c_chars_to_str function in the dbn crate. This vulnerability occurs because the CStr::from_ptr() function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.
If the chars array does not contain a null byte (\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.
Which versions are affected by GHSA-pfr9-2p92-qrhq?
3 open source packages ship an affected version, including dbn.
| Package | Affected | Fixed in |
|---|---|---|
dbn crates.io | All versions | 0.22.1 |
dbn crates.io | All versions | 0.22.1 |
dbn crates.io | From 0.0.0-0 | 0.22.1-0 |
How do I fix GHSA-pfr9-2p92-qrhq?
Upgrade dbn to a fixed version for your release line: 0.22.1 or 0.22.1-0.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-pfr9-2p92-qrhq being exploited?
There is no known exploitation of GHSA-pfr9-2p92-qrhq in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0377.