Generated code can read and write out of bounds in safe code

published 2021-10-31 5y ago modified 2023-11-08 3y ago also RUSTSEC-2021-0122

cvss: 9.8; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Code generated by flatbuffers' compiler is `unsafe` but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details.

All users that use generated code by `flatbuffers` compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit their code and look for any usage of `follow`, `push`, or any method that uses them (e.g. `self_follow`). 3. Carefuly go through the crates' documentation to understand which "safe" APIs are not intended to be used.

Patch / fix

fixed in 1 links 2

crates.io flatbuffers 22.9.29

github.com/google/flatbuffers#7518 pull request
github.com/google/flatbuffers/releases/tag/v22.9.29 release

Is GHSA-3jch-9qgp-4844 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
crates.io	flatbuffers	<22.9.29 >=0.0.0-0, <22.9.29	22.9.29

References

github.com /google/flatbuffers/pull/7518
web
github.com /google/flatbuffers/issues/6627
web, report
github.com /google/flatbuffers
package
github.com /google/flatbuffers/releases/tag/v22.9.29
web
rustsec.org /advisories/RUSTSEC-2021-0122.html
web, advisory
crates.io /crates/flatbuffers
package

Sources

GitHub Advisory GHSA-3jch-9qgp-4844
OSV RUSTSEC-2021-0122

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.