PT-2024-40398 · Dbn · Dbn
Published
2024-10-09
·
Updated
2024-10-09
CVSS v4.0
6.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
dbn crate (affected versions not specified)
Description
The issue occurs in the
c chars to str function within the dbn crate, specifically when the strlen() function is called. This happens because the CStr::from ptr() function in Rust expects a null-terminated C string, but there's no guarantee that the input chars array passed to c chars to str is properly null-terminated. If the chars array lacks a null byte (0), strlen() will read beyond the buffer's bounds, leading to an out-of-bounds memory read and potentially causing a heap-buffer-overflow. This could result in memory corruption or exposure of sensitive information.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Buffer Over-read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dbn