PT-2025-55195 · Crates.Io · Vku

Published 2025-04-23 · Updated 2025-04-23

OSV

VMABuffer::set data was a publicly accessible safe function. It accepted an arbitrary offset and a data slice, then used the offset in unsafe pointer arithmetic before copying the slice into a mapped allocation.

Affected versions did not check that the requested write range fit within the allocation before calling ptr.add(offset) and copy from nonoverlapping. Safe Rust code could therefore trigger an out-of-bounds write by passing an offset outside the mapped allocation.

This makes the safe API unsound, since callers can trigger undefined behavior without using unsafe.

Version 0.4.0 added a bounds check before performing the pointer arithmetic and copy.

Related Identifiers

RUSTSEC-2025-0162

Affected Products

Vku

References · 5

• https://osv.dev/vulnerability/RUSTSEC-2025-0162 · Vendor Advisory
• https://github.com/ArrowMaxGithub/vku/issues/5 · Note
• https://github.com/ArrowMaxGithub/vku/commit/ce02c19ec35e5ee84c00ec5005be9d6d44599b5f · Note
• https://crates.io/crates/vku · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0162.html · Note