PT-2024-40952 · Pprof · Pprof
Published
2024-12-04
·
Updated
2024-12-04
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
pprof versions prior to 0.14.0
Description
The issue arises from the unsafe usage of the
std::slice::from raw parts API, specifically in the TempFdArrayIterator.next function and when validating addresses with type c void. This can lead to the creation and passing of misaligned pointers and potential exposure of uninitialized memory. The misalignment causes a panic, which in turn makes several downstream applications, such as greptimedb, crash when using pprof::report::ReportBuilder::build.Recommendations
For versions prior to 0.14.0, update to version 0.14.0 or later to resolve the issue. As an alternative, consider moving to
pprof2. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pprof