{"answers":{"affected":"1 open source package ship an affected version, including pkcs11.","exploited":"There is no known exploitation of RUSTSEC-2022-0034 in the wild and no public exploit code.","fix":"No fix has been published for RUSTSEC-2022-0034 yet. Limit exposure of the affected software until one is available.","what":"RUSTSEC-2022-0034 is an use after free vulnerability in pkcs11, published on 22 Jul 2022."},"fix_prompt":"Check this codebase for RUSTSEC-2022-0034 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2022-0034 is an use after free vulnerability in pkcs11, published on 22 Jul 2022. \nExploitation: There is no known exploitation of RUSTSEC-2022-0034 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pkcs11 (crates.io): affected from 0.0.0-0; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2022-0034/ (Markdown: https://insights.sbomify.com/RUSTSEC-2022-0034/index.md)","id":"RUSTSEC-2022-0034","markdown":"https://insights.sbomify.com/RUSTSEC-2022-0034/index.md","name":"RUSTSEC-2022-0034","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"workaround","impacts":["denial_of_service","code_execution"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust PKCS#11 library","requires_auth":"unknown","summary":"Unsafe pointer handling in the pkcs11 Rust crate can cause segmentation faults, undefined behavior, and potential code execution due to use-after-free issues.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nThe interface of `pkcs11` is subject to a number of safety issues, mainly related to handling of raw pointers. Despite presenting a safe interface, many of the functions and methods that rely on inputs which contain pointers (attributes and mechanisms in particular) can lead to segmentation faults and undefined behaviour when those pointers get dereferenced. For more details see the issues referenced below.\n\nOther problems that have been identified by the community include use-after-free ([mheese/rust-pkcs11#53](https://github.com/mheese/rust-pkcs11/pull/53)) and unsound uses of `transmute_copy` ([mheese/rust-pkcs11#55](https://github.com/mheese/rust-pkcs11/issues/55)).\n\n### Workarounds\n\nUsers of the crate need to be _extremely_ careful in all the calls made to avoid segmentation faults and undefined behaviour due to use of stale pointers. Whenever a pointer is derived from a value and passed to the library, that value's lifetime must be guaranteed to outlast all calls that rely on the pointer. For example, users should **avoid** creating or converting values within a separate scope (say, in a dedicated function), deriving a pointer, then extracting the pointer from that scope leaving the value to get dropped before passing the pointer to `pkcs11`.\n\n### References\n\n- [mheese/rust-pkcs11#38](https://github.com/mheese/rust-pkcs11/issues/38)\n- [mheese/rust-pkcs11#53](https://github.com/mheese/rust-pkcs11/pull/53)\n- [mheese/rust-pkcs11#55](https://github.com/mheese/rust-pkcs11/issues/55)\n- [mheese/rust-pkcs11#54](https://github.com/mheese/rust-pkcs11/issues/54)\n- [mheese/rust-pkcs11#50](https://github.com/mheese/rust-pkcs11/issues/50)","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Safety issues in `pkcs11`","id":"RUSTSEC-2022-0034","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"use_after_free","year":"2022"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":[],"introduced":["0.0.0-0"],"last_affected":[],"package":"pkcs11","purl":"pkg:cargo/pkcs11","source":"RUSTSEC-2022-0034"}],"products":null,"published":"2022-07-22","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unsafe pointer handling in the pkcs11 Rust crate can cause segmentation faults, undefined behavior, and potential code execution due to use-after-free issues.","url":"https://insights.sbomify.com/RUSTSEC-2022-0034/"}