Skip to content
Fencer Intel
high —

GHSA-rxhx-9fj6-6h2m json

enum_map macro can cause UB when `Enum` trait is incorrectly implemented

published 4y ago modified 3y ago also RUSTSEC-2022-0010

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length.

When the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the initialization of the enum map with uninitialized types, which in turn can allow an attacker to execute arbitrary code.

This problem can only occur with a manual implementation of the Enum trait, it will never occur for enums that use `#[derive(Enum)]`.

Example code that triggers this vulnerability looks like this:

```rust enum E { A, B, C, }

impl Enum for E { const LENGTH: usize = 2;

fn from_usize(value: usize) -> E { match value { 0 => E::A, 1 => E::B, 2 => E::C, _ => unimplemented!(), } }

fn into_usize(self) -> usize { self as usize } }

impl<V> EnumArray<V> for E { type Array = [V; 3]; }

let _map: EnumMap<E, String> = enum_map! { _ => "Hello, world!".into() }; ```

The flaw was corrected in commit [b824e23](https://github.com/xfix/enum-map/commit/b824e232f2fb47837740070096ac253df8e80dfc) by putting `LENGTH` property on sealed trait for macro to read.

Patch / fix

  • crates.io enum-map 2.0.2

Is GHSA-rxhx-9fj6-6h2m in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io enum-map
>=2.0.0-2, <2.0.2
2.0.2

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.