Skip to content
Fencer Intel
high 8.2

GHSA-w5w5-8vfh-xcjq json

whoami stack buffer overflow on several Unix platforms

published 2y ago modified 2y ago also RUSTSEC-2024-0020

cvss
8.2
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

With versions of the whoami crate >= 0.5.3 and < 1.5.0, calling any of these functions leads to an immediate stack buffer overflow on illumos and Solaris:

- `whoami::username` - `whoami::realname` - `whoami::username_os` - `whoami::realname_os`

With versions of the whoami crate >= 0.5.3 and < 1.0.1, calling any of the above functions also leads to a stack buffer overflow on these platforms:

- Bitrig - DragonFlyBSD - FreeBSD - NetBSD - OpenBSD

This occurs because of an incorrect definition of the `passwd` struct on those platforms.

As a result of this issue, denial of service and data corruption have both been observed in the wild. The issue is possibly exploitable as well.

This vulnerability also affects other Unix platforms that aren't Linux or macOS.

This issue has been addressed in whoami 1.5.0.

For more information, see [this GitHub issue](https://github.com/ardaku/whoami/issues/91).

Patch / fix

  • crates.io whoami 1.5.0

Is GHSA-w5w5-8vfh-xcjq in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected packages

ecosystem package affected fixed in
crates.io whoami
>=0.5.3, <1.5.0
1.5.0

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.