RUSTSEC-2020-0123

Contents of uninitialized memory exposed in DeflateOutput's AsyncRead implementation

Reported

January 24, 2020

Issued

January 27, 2021 (last modified: June 13, 2023)

Package

libp2p-deflate (crates.io)

Type

Vulnerability

Categories

memory-exposure

Aliases

References

https://github.com/libp2p/rust-libp2p/issues/1932

CVSS Score

9.8 CRITICAL

CVSS Details

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patched

>=0.27.1

Description

Affected versions of this crate passes an uninitialized buffer to a user-provided trait function AsyncRead::poll_read().

Arbitrary AsyncRead::poll_read() implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

The flaw was fixed in commit 5ba266a by ensuring the newly allocated part of the buffer is zero-initialized before passing it to a user-provided AsyncRead::poll_read().

Advisory available under CC0-1.0 license.