RUSTSEC-2020-0167

pnet_packet buffer overrun in set_payload setters

Reported

June 19, 2020

Issued

February 9, 2023 (last modified: June 13, 2023)

Package

pnet_packet (crates.io)

Type

Vulnerability

Categories

memory-corruption

Aliases

GHSA-cf4g-fcf8-3cr9

References

https://github.com/libpnet/libpnet/issues/449

CVSS Score

6 MEDIUM

CVSS Details

Attack vector: Local
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Patched

>=0.27.2

Description

As indicated by this issue, a buffer overrun is possible in the set_payload setter of the various mutable "Packet" struct setters. The offending set_payload functions were defined within the struct impl blocks in earlier versions of the package, and later by the packet macro.

Fixed in the packet macro by this PR.

Advisory available under CC0-1.0 license.