CVE-2019-25004: Unsound casting in flatbuffers

August 25, 2021 (updated June 13, 2023)

The implementation of impl Follow for bool allows to reinterpret arbitrary bytes as a bool.

In Rust bool has stringent requirements for its in-memory representation. Use of this function allows to violate these requirements and invoke undefined behaviour in safe code.

References

github.com/advisories/GHSA-gx73-2498-r55c
github.com/google/flatbuffers
github.com/google/flatbuffers/issues/5530
nvd.nist.gov/vuln/detail/CVE-2019-25004
rustsec.org/advisories/RUSTSEC-2019-0028.html

Code Behaviors & Features

Detect and mitigate CVE-2019-25004 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →