Skip to content
Fencer Intel
low —

GHSA-gw5w-5j7f-jmjj json

Unsound usages of `std::slice::from_raw_parts`

published last yr. modified 2mo ago also RUSTSEC-2024-0408

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The library breaks the safety assumptions when using unsafe API `std::slice::from_raw_parts`. First, when using the API in iterator implementation (`TempFdArrayIterator.next`), generic type could be any type, which would create and pass a misaligned pointer to the unsafe API. Second, when validating the address, the code passed the type `c_void`, which could also be any type, leading to potential uninitialized memory exposure.

Two unsound usages here highlight the necessity for developers to perform type checks before doing type conversion with unsafe API.

The panic caused by the misalignment causes several downstream applications (e.g., `greptimedb`) to crash when using `pprof::report::ReportBuilder::build`.

This was patched in 0.14.0.

The developer also suggested moving to [pprof2](https://crates.io/crates/pprof2).

Patch / fix

  • crates.io pprof 0.14.0

Is GHSA-gw5w-5j7f-jmjj in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io pprof
<0.14.0
>=0.0.0-0, <0.14.0
0.14.0

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.