RUSTSEC-2019-0008

Flaw in string parsing can lead to crashes due to invalid memory access.

Reported

June 24, 2019

Issued

October 1, 2020 (last modified: June 13, 2023)

Package

simd-json (crates.io)

Type

Vulnerability

Keywords

#simd

Aliases

References

https://github.com/Licenser/simdjson-rs/pull/27

CVSS Score

7.5 HIGH

CVSS Details

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.1.15

Unaffected

<=0.1.13

Affected Architectures

x86
x86_64

Description

The affected version of this crate did not guard against accessing memory beyond the range of its input data. A pointer cast to read the data into a 256-bit register could lead to a segmentation fault when the end plus the 32 bytes (256 bit) read would overlap into the next page during string parsing.

page   |  ...  page 1  ...  | ... page 2  ... |
data   | x[n * 32 byte]xx__ |                 |
access | ..][ 32 byte ]     |                 |
segflt |               [ 32 | byte ]          |

This allows an attacker to eventually crash a service.

The flaw was corrected by using a padding buffer for the last read from the input. So that we are we never read over the boundary of the input data.

Advisory available under CC0-1.0 license.