PT-2025-45795 · Crates.Io · Borrowck Sacrifices

Publicado 2025-10-22 · Atualizado 2025-10-22

OSV

CVSS v4.0

2.0

Baixa

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

The safe function any as u8 slice can create byte slices that reference uninitialized memory when used with types containing padding bytes.

The function uses slice::from raw parts to create a &[u8] covering the entire size of a type, including padding bytes. According to Rust's documentation, from raw parts requires all bytes to be properly initialized, but padding bytes in structs are not guaranteed to be initialized. This violates the safety contract and causes undefined behavior.

Correção

Access of Uninitialized Pointer

Enumeração de Fraquezas

CWE-824

Identificadores relacionados

GHSA-XCPM-76HF-C9CC

Produtos afetados

Borrowck Sacrifices

Referências · 5

• https://github.com/alexpyattaev/borrowck_sacrifices · Nota
• https://osv.dev/vulnerability/GHSA-xcpm-76hf-c9cc · Aviso do Fabricante
• https://github.com/alexpyattaev/borrowck_sacrifices/commit/1bdaa14da68a6e8207f9e81359116f53139800f2 · Nota
• https://rustsec.org/advisories/RUSTSEC-2025-0107.html · Nota
• https://github.com/alexpyattaev/borrowck_sacrifices/issues/1 · Nota