GHSA-wm8x-php5-hvq6 Maligned causes incorrect deallocation
Incorrect memory deallocation in the maligned crate can lead to undefined behavior, potentially allowing code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-wm8x-php5-hvq6?
GHSA-wm8x-php5-hvq6 is a memory corruption vulnerability in maligned, published on 4 Mar 2023.
Official description
maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.
GlobalAlloc::dealloc requires that the layout argument must be the same layout that was used to allocate that block of memory.
When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.
Which versions are affected by GHSA-wm8x-php5-hvq6?
3 open source packages ship an affected version, including maligned.
| Package | Affected | Fixed in |
|---|---|---|
maligned crates.io | All versions to 0.2.1 | None |
maligned crates.io | All versions to 0.2.1 | None |
maligned crates.io | From 0.0.0-0 | None |
How do I fix GHSA-wm8x-php5-hvq6?
No fix has been published for GHSA-wm8x-php5-hvq6 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-wm8x-php5-hvq6 being exploited?
There is no known exploitation of GHSA-wm8x-php5-hvq6 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0017.