~ / search / GHSA-w428-f65r-h4q2

GHSA-w428-f65r-h4q2

Deserialization of Untrusted Data in rust-cpuid

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-45687

Packages

EcosystemPackageAffectedFixed in
crates.io raw-cpuid >= 3.1.0, < 9.1.1 9.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.

References

External links from the advisory. They lead to third-party sites.