Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. memoffset
  4. ›
  5. GHSA-wfg4-322g-9vqv

GHSA-wfg4-322g-9vqv: memoffset allows reading uninitialized memory

June 21, 2023

memoffset allows attempt of reading data from address 0 with arbitrary type. This behavior is an undefined behavior because address 0 to std::mem::size_of<T> may not have valid bit-pattern with T. Old implementation dereferences uninitialized memory obtained from std::mem::align_of. Older implementation prior to it allows using uninitialized data obtained from std::mem::uninitialized with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for “father” that includes (directly or transitively) type that does not allow to be uninitialized.

This flaw was corrected by using std::ptr::addr_of in https://github.com/Gilnaa/memoffset/pull/50.

References

  • github.com/Gilnaa/memoffset
  • github.com/Gilnaa/memoffset/issues/24
  • github.com/Gilnaa/memoffset/pull/50
  • github.com/advisories/GHSA-wfg4-322g-9vqv
  • rustsec.org/advisories/RUSTSEC-2023-0045.html

Code Behaviors & Features

Detect and mitigate GHSA-wfg4-322g-9vqv with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.6.2

Fixed versions

  • 0.6.2

Solution

Upgrade to version 0.6.2 or above.

Source file

cargo/memoffset/GHSA-wfg4-322g-9vqv.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:20 +0000.