Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. rustix
  4. ›
  5. GHSA-c827-hfw6-qwvm

GHSA-c827-hfw6-qwvm: rustix's `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion

October 18, 2023

When using rustix::fs::Dir using the linux_raw backend, it’s possible for the iterator to “get stuck” when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::read_more, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application.

References

  • discord.com/channels/273534239310479360/1161137828395237556
  • github.com/advisories/GHSA-c827-hfw6-qwvm
  • github.com/bytecodealliance/rustix
  • github.com/bytecodealliance/rustix/commit/31fd98ca723b93cc6101a3e29843ea5cf094e159
  • github.com/bytecodealliance/rustix/commit/87481a97f4364d12d5d6f30cdd025a0fc509b8ec
  • github.com/bytecodealliance/rustix/commit/df3c3a192cf144af0da8a57417fb4addbdc611f6
  • github.com/bytecodealliance/rustix/commit/eecece4a84fc58eafdc809cc2cedd374dee876a5
  • github.com/bytecodealliance/rustix/security/advisories/GHSA-c827-hfw6-qwvm
  • github.com/imsnif/bandwhich/issues/284
  • github.com/imsnif/bandwhich/issues/284

Code Behaviors & Features

Detect and mitigate GHSA-c827-hfw6-qwvm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.35.11 before 0.35.15, all versions starting from 0.36.0 before 0.36.16, all versions starting from 0.37.0 before 0.37.25, all versions starting from 0.38.0 before 0.38.19

Fixed versions

  • 0.35.15
  • 0.36.16
  • 0.37.25
  • 0.38.19

Solution

Upgrade to versions 0.35.15, 0.36.16, 0.37.25, 0.38.19 or above.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Source file

cargo/rustix/GHSA-c827-hfw6-qwvm.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:01 +0000.