Vulnerability · Published Jan 2, 2024 · Assigned by GitHub_M
CVE-2023-50711`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access
Medium 5.7
In plain English
A medium-severity out-of-bounds write in vmm-sys-util from rust-vmm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the `FamStructWrapper::deserialize` implementation provided by the crate for `vmm_sys_util::fam::FamStructWrapper` can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array length. Mismatch in the lengths might allow out of bounds memory access through Rust-safe methods. The issue was corrected in version 0.12.0 by inserting a check that verifies the lengths of compared flexible arrays are equal for any deserialized header and aborting deserialization otherwise. Moreover, the API was changed so that header length can only be modified through Rust-unsafe code. This ensures that users cannot trigger out-of-bounds memory access from Rust-safe code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-vmm-sys-util | 0.12.1-1 | DEBIAN-CVE-2023-50711 |
| Debian:14 | rust-vmm-sys-util | 0.12.1-1 | DEBIAN-CVE-2023-50711 |
| Ubuntu:24.04:LTS | rust-vmm-sys-util | no fix listed | UBUNTU-CVE-2023-50711 |
| Ubuntu:25.10 | rust-vmm-sys-util | no fix listed | UBUNTU-CVE-2023-50711 |
| Ubuntu:26.04:LTS | rust-vmm-sys-util | no fix listed | UBUNTU-CVE-2023-50711 |
| Ubuntu:26.10 | rust-vmm-sys-util | no fix listed | UBUNTU-CVE-2023-50711 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rust-vmm | vmm-sys-util | >= 0.5.0, < 0.12.0 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
References
- https://github.com/rust-vmm/vmm-sys-util/security/advisories/GHSA-875g-mfp6-g7f9 x_refsource_CONFIRM
- https://github.com/rust-vmm/vmm-sys-util/commit/30172fca2a8e0a38667d934ee56682247e13f167 x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5XMCLV2P3ANS3XN4NXZTV4PUNTLWUNJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJI7D273R6G5RUC246KTI2YY3AXZKZMD/