Skip to content
OpenAdvisories
Medium · 5.7 CVE-2023-28448 EUVD-2023-0952GHSA-8vxc-r5wp-vgvcRUSTSEC-2023-0030

Versionize is lacking bound checks, potentially leading to out of bounds memory access

Published Mar 24, 2023 · Updated Feb 19, 2025 · Assigned by GitHub_M

Description

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

Affected products

VendorProductAffectedFixed
firecracker-microvm versionize < 0.1.10 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) cloud-hypervisor 30.0-2 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io versionize >= 0.1.1, < 0.1.10 0.1.10 GHSA-8vxc-r5wp-vgvc
crates.io versionize >= 0.0.0-0, < 0.1.10 0.1.10 RUSTSEC-2023-0030

References