Headline
GHSA-49hh-fprx-m68g: Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses
Impact
An issue was discovered in the default implementations of the VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}
trait functions, which allows out-of-bounds memory access if the VolatileMemory::get_slice
function returns a VolatileSlice
whose length is less than the function’s count
argument. No implementations of get_slice
provided in vm_memory
are affected. Users of custom VolatileMemory
implementations may be impacted if the custom implementation does not adhere to get_slice
's documentation.
Patches
The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the VolatileSlice
returned by get_slice
is of the correct length.
Workarounds
Not Required
References
https://github.com/rust-vmm/vm-memory/commit/aff1dd4a5259f7deba56692840f7a2d9ca34c9c8 https://crates.io/crates/vm-memory/0.12.2
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2023-41051
Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses
Low severity GitHub Reviewed Published Sep 1, 2023 in rust-vmm/vm-memory • Updated Sep 4, 2023
Package
cargo vm-memory (Rust)
Affected versions
< 0.12.2
Description
Published to the GitHub Advisory Database
Sep 4, 2023
Severity
CVSS base metrics
User interaction
Required
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
GHSA ID
GHSA-49hh-fprx-m68g
Source code
Related news
In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers and vhost drivers, that need to access the VM physical memory. The vm-memory rust crate provides a set of traits to decouple VM memory consumers from VM memory providers. An issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less than the function’s `count` argument. No implementations of `get_slice` provided in `vm_memory` are affected. Users of custom `VolatileMemory` implementations may be impacted if the custom implementation does not adhere to `get_slice`'s documentation. The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returne...