PT-2024-40279 · Mimalloc · Mimalloc

Published 2024-11-12 · Updated 2024-11-12

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions: No specific software name or version is mentioned, however, the issue concerns a crate that depends on the mimalloc allocator.

Description: The issue arises from a change in the mimalloc allocator's logic, which broke a promise regarding alignments. This caused the crate to return memory with incorrect alignment for certain allocations, particularly those with large alignments. The problem was resolved by using aligned allocation functions.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-G23H-7VF9-XC25

Affected Products

Mimalloc

References · 4

• https://osv.dev/vulnerability/GHSA-g23h-7vf9-xc25 · Vendor Advisory
• https://github.com/purpleprotocol/mimalloc_rust/issues/87 · Note
• https://github.com/purpleprotocol/mimalloc_rust · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0094.html · Note