GHSA-8vxc-r5wp-vgvc

Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-28448

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	versionize	>= 0.1.1, < 0.1.10	0.1.10

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses. ### Patches The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise. ### Workarounds \- ### References - https://github.com/firecracker-microvm/versionize/pull/53

References

External links from the advisory. They lead to third-party sites.