CVE-2023-28448CWE-125

Versionize is lacking bound checks, potentially leading to out of bounds memory access

Medium · published March 24, 2023

CVSS v3.1
5.7
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00556 · 45.6th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2023-03-24T19:34Z
EPSS history
Timeline
  • 24 MAR 19:34Z
    Versionize is lacking bound checks, potentially leading to out of bounds memory access
    cvelistv5