CVE-2023-28448
Summary
| CVE | CVE-2023-28448 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-03-24 20:15:00 UTC |
|---|
| Updated | 2023-11-07 04:10:00 UTC |
|---|
| Description | Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Add missing bounds check to `<FamStructWrapper as Versionize>::deserialize` by roypat · Pull Request #53 · firecracker-microvm/versionize · GitHub |
MISC |
github.com |
|
| Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses · Advisory · firecracker-microvm/versionize · GitHub |
MISC |
github.com |
|
| Add missing bounds check to FamStructWrapper::deserialize · firecracker-microvm/versionize@a57a051 · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 906746 Common Base Linux Mariner (CBL-Mariner) Security Update for cloud-hypervisor (25843-1)
- 906778 Common Base Linux Mariner (CBL-Mariner) Security Update for cloud-hypervisor (25874-1)
- 996228 Rust (Rust) Security Update for versionize (GHSA-8vxc-r5wp-vgvc)
