GHSA-rxhx-9fj6-6h2m json
enum_map macro can cause UB when `Enum` trait is incorrectly implemented
published 4y ago modified 3y ago also RUSTSEC-2022-0010
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length.
When the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the initialization of the enum map with uninitialized types, which in turn can allow an attacker to execute arbitrary code.
This problem can only occur with a manual implementation of the Enum trait, it will never occur for enums that use `#[derive(Enum)]`.
Example code that triggers this vulnerability looks like this:
```rust enum E { A, B, C, }
impl Enum for E { const LENGTH: usize = 2;
fn from_usize(value: usize) -> E { match value { 0 => E::A, 1 => E::B, 2 => E::C, _ => unimplemented!(), } }
fn into_usize(self) -> usize { self as usize } }
impl<V> EnumArray<V> for E { type Array = [V; 3]; }
let _map: EnumMap<E, String> = enum_map! { _ => "Hello, world!".into() }; ```
The flaw was corrected in commit [b824e23](https://github.com/xfix/enum-map/commit/b824e232f2fb47837740070096ac253df8e80dfc) by putting `LENGTH` property on sealed trait for macro to read.
Patch / fix
Is GHSA-rxhx-9fj6-6h2m in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | enum-map | >=2.0.0-2, <2.0.2 |
2.0.2 |
References
-
github.com
/xfix/enum-map/commit/b824e232f2fb47837740070096ac253df8e80dfc
web
-
github.com
/rustsec/advisory-db/blob/main/crates/enum-map/RUSTSEC-2022-0010.md
web
-
github.com
/xfix/enum-map
package
-
github.com
/xfix/enum-map/blob/master/CHANGELOG.md#version-202
web
-
gitlab.com
/KonradBorowski/enum-map/-/blob/master/CHANGELOG.md#version-202
web
-
rustsec.org
/advisories/RUSTSEC-2022-0010.html
web, advisory
-
crates.io
/crates/enum-map
package
Sources
- GitHub Advisory GHSA-rxhx-9fj6-6h2m
- OSV RUSTSEC-2022-0010
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.