Log in Start free

Vulnerability · Published Sep 1, 2023 · Assigned by GitHub_M

CVE-2023-41051Default functions in VolatileMemory trait lack bounds checks in vm-memory

Low 2.5

In plain English

A low-severity out-of-bounds read in vm-memory from rust-vmm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.3%top 82.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers and vhost drivers, that need to access the VM physical memory. The vm-memory rust crate provides a set of traits to decouple VM memory consumers from VM memory providers. An issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less than the function’s `count` argument. No implementations of `get_slice` provided in `vm_memory` are affected. Users of custom `VolatileMemory` implementations may be impacted if the custom implementation does not adhere to `get_slice`'s documentation. The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returned by `get_slice` is of the correct length. Users are advised to upgrade. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-vm-memoryno fix listedDEBIAN-CVE-2023-41051
Debian:13rust-vm-memory0.12.2-1DEBIAN-CVE-2023-41051
Debian:14rust-vm-memory0.12.2-1DEBIAN-CVE-2023-41051
Ubuntu:24.04:LTSrust-vm-memoryno fix listedUBUNTU-CVE-2023-41051

Affected products (as reported)

VendorProductVersions
rust-vmm vm-memory >= 0.1.0, < 0.12.2

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

References