GHSA-qm2p-4w45-v2vr grcov has an out of bounds write triggered by crafted coverage data
An attacker can achieve arbitrary code execution by providing crafted coverage data to the grcov tool, which fails to validate array indices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-qm2p-4w45-v2vr?
GHSA-qm2p-4w45-v2vr is a memory corruption vulnerability in grcov, published on 13 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Function grcov::covdir::get_coverage uses the unsafe function get_unchecked_mut without validating that the index is in bounds.
This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.
Which versions are affected by GHSA-qm2p-4w45-v2vr?
3 open source packages ship an affected version, including grcov.
| Package | Affected | Fixed in |
|---|---|---|
grcov crates.io | All versions | 0.8.20 |
grcov crates.io | All versions | 0.8.20 |
grcov crates.io | From 0.0.0-0 | 0.8.21-0 |
How do I fix GHSA-qm2p-4w45-v2vr?
Upgrade grcov to a fixed version for your release line: 0.8.20 or 0.8.21-0.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-qm2p-4w45-v2vr being exploited?
There is no known exploitation of GHSA-qm2p-4w45-v2vr in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0005.