PT-2021-17721 · Unknown · Byte Struct
Wwylele
·
Published
2021-03-01
·
Updated
2022-05-03
·
CVE-2021-28033
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
byte struct crate versions prior to 0.6.1
Description:
An issue was discovered in the byte struct crate where a drop of uninitialized memory can occur if a certain deserialization method panics. Specifically, the
read bytes default le function for [T; n] arrays used to deserialize arrays of T from bytes created a [T; n] array with std::mem::uninitialized and then called T's deserialization method. If T's deserialization method panicked, the uninitialized memory could drop invalid objects.Recommendations:
For versions prior to 0.6.1, update to version 0.6.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the
read bytes default le function for [T; n] arrays until a patch is available. Restrict access to the deserialization method to minimize the risk of exploitation.Fix
Buffer Overflow
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Byte Struct