Reported

December 23, 2024

Issued

December 28, 2024

Package

xous (crates.io)

Type

INFO Unsound

References

• https://github.com/betrusted-io/xous-core/issues/410
• https://github.com/betrusted-io/xous-core/pull/411

Patched

• >=0.9.51

Affected Functions

Version

xous::definitions::MemoryRange::as_slice

• <0.9.51

xous::definitions::MemoryRange::as_slice_mut

• <0.9.51

Description

We consider as_slice and as_slice_mut unsound because: the pointer with any bit patterns could be cast to the slice of arbitrary types. The pointer could be created by unsafe new and deprecated from_parts. We consider that from_parts should be removed in latest version because it will help trigger unsoundness in as_slice. With new declared as unsafe, as_slice should also declared as unsafe.

This was patched in by marking two functions as unsafe.

Advisory available under CC0-1.0 license.