mirror of
https://github.com/OMGeeky/advisory-db.git
synced 2026-01-23 11:49:05 +01:00
Add unsound ntru (#1652)
* Add ntru unsoundness advisory * Remove redundant unaffected * Remove non-versions --------- Co-authored-by: pinkforest(she/her) <36498018+pinkforest@users.noreply.github.com>
This commit is contained in:
30
crates/ntru/RUSTSEC-0000-0000.md
Normal file
30
crates/ntru/RUSTSEC-0000-0000.md
Normal file
@@ -0,0 +1,30 @@
|
||||
```toml
|
||||
[advisory]
|
||||
id = "RUSTSEC-0000-0000"
|
||||
package = "ntru"
|
||||
date = "2023-03-22"
|
||||
url = "https://github.com/FrinkGlobal/ntru-rs/issues/8"
|
||||
categories = ["memory-corruption"]
|
||||
keywords = ["ffi", "buffer overflow"]
|
||||
informational = "unsound"
|
||||
|
||||
[versions]
|
||||
patched = []
|
||||
|
||||
[affected.functions]
|
||||
"ntru::types::PrivateKey::export" = [">= 0.4.3"]
|
||||
"ntru::types::PublicKey::export" = [">= 0.4.3"]
|
||||
```
|
||||
|
||||
# Unsound FFI: Wrong API usage causes write past allocated area
|
||||
|
||||
The following usage causes undefined behavior.
|
||||
```rust
|
||||
let kp: ntru::types::KeyPair = …;
|
||||
kp.get_public().export(Default::default())
|
||||
```
|
||||
|
||||
When compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.
|
||||
Other mistakes (e.g. using `EncParams` from a different key) may always trigger UB.
|
||||
|
||||
Likely, older versions of this crate are also affected, but have not been tested.
|
||||
Reference in New Issue
Block a user