Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. memoffset
  4. ›
  5. GHSA-wfg4-322g-9vqv

GHSA-wfg4-322g-9vqv: memoffset allows reading uninitialized memory

June 21, 2023

memoffset allows attempt of reading data from address 0 with arbitrary type. This behavior is an undefined behavior because address 0 to std::mem::size_of<T> may not have valid bit-pattern with T. Old implementation dereferences uninitialized memory obtained from std::mem::align_of. Older implementation prior to it allows using uninitialized data obtained from std::mem::uninitialized with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for “father” that includes (directly or transitively) type that does not allow to be uninitialized.

This flaw was corrected by using std::ptr::addr_of in https://github.com/Gilnaa/memoffset/pull/50.

References

  • github.com/Gilnaa/memoffset
  • github.com/Gilnaa/memoffset/issues/24
  • github.com/Gilnaa/memoffset/pull/50
  • github.com/advisories/GHSA-wfg4-322g-9vqv
  • rustsec.org/advisories/RUSTSEC-2023-0045.html

Code Behaviors & Features

Detect and mitigate GHSA-wfg4-322g-9vqv with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.6.2

Fixed versions

  • 0.6.2

Solution

Upgrade to version 0.6.2 or above.

Source file

cargo/memoffset/GHSA-wfg4-322g-9vqv.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:24 +0000.