RUSTSEC-2022-0034 Safety issues in `pkcs11`
Unsafe pointer handling in the pkcs11 Rust crate can cause segmentation faults, undefined behavior, and potential code execution due to use-after-free issues.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2022-0034?
RUSTSEC-2022-0034 is an use after free vulnerability in pkcs11, published on 22 Jul 2022.
Official description
Impact
The interface of pkcs11 is subject to a number of safety issues, mainly related to handling of raw pointers. Despite presenting a safe interface, many of the functions and methods that rely on inputs which contain pointers (attributes and mechanisms in particular) can lead to segmentation faults and undefined behaviour when those pointers get dereferenced. For more details see the issues referenced below.
Other problems that have been identified by the community include use-after-free (mheese/rust-pkcs11#53) and unsound uses of transmute_copy (mheese/rust-pkcs11#55).
Workarounds
Users of the crate need to be extremely careful in all the calls made to avoid segmentation faults and undefined behaviour due to use of stale pointers. Whenever a pointer is derived from a value and passed to the library, that value's lifetime must be guaranteed to outlast all calls that rely on the pointer. For example, users should avoid creating or converting values within a separate scope (say, in a dedicated function), deriving a pointer, then extracting the pointer from that scope leaving the value to get dropped before passing the pointer to pkcs11.
References
Which versions are affected by RUSTSEC-2022-0034?
1 open source package ship an affected version, including pkcs11.
| Package | Affected | Fixed in |
|---|---|---|
pkcs11 crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2022-0034?
No fix has been published for RUSTSEC-2022-0034 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2022-0034 being exploited?
There is no known exploitation of RUSTSEC-2022-0034 in the wild and no public exploit code.