From 516ebee12d07635f6772e7fd6bdfb338fd648b66 Mon Sep 17 00:00:00 2001 From: sidunder <124012191+sidunder@users.noreply.github.com> Date: Wed, 8 Feb 2023 23:10:46 -0400 Subject: [PATCH] Add advisory for pnet_packet (#1595) Co-authored-by: sidunder --- crates/pnet_packet/RUSTSEC-0000-0000.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 crates/pnet_packet/RUSTSEC-0000-0000.md diff --git a/crates/pnet_packet/RUSTSEC-0000-0000.md b/crates/pnet_packet/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..24e06c5 --- /dev/null +++ b/crates/pnet_packet/RUSTSEC-0000-0000.md @@ -0,0 +1,18 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "pnet_packet" +date = "2020-06-19" +url = "https://github.com/libpnet/libpnet/issues/449" +categories = ["memory-corruption"] +cvss = "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H" + +[versions] +patched = [">= 0.27.2"] +``` + +# `pnet_packet` buffer overrun in `set_payload` setters + +As indicated by this [issue](https://github.com/libpnet/libpnet/issues/449#issuecomment-663355987), a buffer overrun is possible in the `set_payload` setter of the various mutable "Packet" struct setters. The offending `set_payload` functions were defined within the struct `impl` blocks in earlier versions of the package, and later by the `packet` macro. + +Fixed in the `packet` macro by [this](https://github.com/libpnet/libpnet/pull/455) PR.