PT-2024-40411 · Unknown · Simd-Json-Derive

Published 2024-11-12 · Updated 2024-11-12

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions simd-json-derive versions prior to 0.12.0

Description The issue arises from an invalid use of MaybeUninit::uninit().assume init() in the derive macro of simd-json-derive, leading to undefined behavior. This misuse can cause invalid memory access and result in panics in binaries compiled in release mode.

Recommendations For versions prior to 0.12.0, update to version 0.12.0 or later to resolve the issue, as it removes the problematic code section and avoids the use of MaybeUninit altogether.

Fix

Related Identifiers

GHSA-PQPW-89W5-82V5

Affected Products

Simd-Json-Derive

References · 4

• https://osv.dev/vulnerability/GHSA-pqpw-89w5-82v5 · Vendor Advisory
• https://github.com/simd-lite/simd-json-derive/issues/67 · Note
• https://github.com/simd-lite/simd-json-derive · Note
• https://rustsec.org/advisories/RUSTSEC-2023-0087.html · Note