From 7086fa22a35e9bd9c08809b83eaad38734d052e6 Mon Sep 17 00:00:00 2001 From: David Koloski Date: Thu, 29 Apr 2021 04:40:04 -0400 Subject: [PATCH] Report rkyv vulnerability (issue rkyv#113) (#877) * Report rkyv vulnerability (issue rkyv#113) * fix category Co-authored-by: Sergey "Shnatsel" Davidoff --- crates/rkyv/RUSTSEC-0000-0000.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 crates/rkyv/RUSTSEC-0000-0000.md diff --git a/crates/rkyv/RUSTSEC-0000-0000.md b/crates/rkyv/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..dda5dff --- /dev/null +++ b/crates/rkyv/RUSTSEC-0000-0000.md @@ -0,0 +1,21 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "rkyv" +date = "2021-04-28" +url = "https://github.com/djkoloski/rkyv/issues/113" +categories = ["memory-exposure"] +keywords = ["uninitialized", "memory", "information", "leak"] + +[versions] +patched = [">= 0.6.0"] + +[affected] +functions = { "rkyv::Archive::resolve" = ["< 0.6.0"] } +``` + +# Archives may contain uninitialized memory + +`rkyv` is a serialization framework that writes struct-compatible memory to be stored or +transmitted. During serialization, struct padding bytes and unused enum bytes may not be +initialized. These bytes may be written to disk or sent over unsecured channels.