PT-2021-24425 · Nalgebra · Nalgebra

Published 2021-08-05 · Updated 2021-08-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: nalgebra versions 0.11.0 through 0.16.13

Description: The issue arises from the Deserialize implementation for VecStorage, which failed to maintain the invariant that the number of elements must equal nrows * ncols. This could allow memory access beyond the allocation of the vector when deserializing specially crafted inputs.

Recommendations: For versions 0.11.0 through 0.16.13, update to a version that includes the fix from commit 5bff536, which returns an error during deserialization if the number of elements does not exactly match the expected size.

Related Identifiers

GHSA-H3MF-4FWP-59C7

Affected Products

Nalgebra

References · 7

• https://osv.dev/vulnerability/GHSA-h3mf-4fwp-59c7 · Vendor Advisory
• https://github.com/dimforge/nalgebra/pull/889 · Note
• https://github.com/dimforge/nalgebra/issues/883 · Note
• https://github.com/dimforge/nalgebra/blob/dev/CHANGELOG.md#0270 · Note
• https://github.com/dimforge/nalgebra · Note
• https://github.com/dimforge/nalgebra/commit/a803271fcce75b7c151e92aa099dfa546db4adc5 · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0070.html · Note