Skip to content
Fencer Intel
medium —

GHSA-3qx8-rv27-j6gp json

Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device`

published last yr. modified last yr. also RUSTSEC-2024-0428

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

An issue was identified in the `VmFd::create_device function`, leading to undefined behavior and miscompilations on rustc 1.82.0 and newer due to the function's violation of Rust's pointer safety rules.

The function downcasted a mutable reference to its `struct kvm_create_device` argument to an immutable pointer, and then proceeded to pass this pointer to a mutating system call. Rustc 1.82.0 and newer elides subsequent reads of this structure's fields, meaning code will not see the value written by the kernel into the `fd` member. Instead, the code will observe the value that this field was initialized to prior to calling `VmFd::create_device` (usually, 0).

The issue started in kvm-ioctls 0.1.0 and was fixed in 0.19.1 by correctly using a mutable pointer.

Patch / fix

  • crates.io kvm-ioctls 0.19.1

Is GHSA-3qx8-rv27-j6gp in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io kvm-ioctls
<0.19.1
>=0.0.0-0, <0.19.1
0.19.1

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.