Vulnerability Details CVE-2023-28448
Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.7%
CVSS Severity
CVSS v3 Score 5.7
References
- https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47
- https://github.com/firecracker-microvm/versionize/pull/53
- https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
- https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47
- https://github.com/firecracker-microvm/versionize/pull/53
- https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
Products affected by CVE-2023-28448
-
cpe:2.3:a:versionize_project:versionize:0.1.1
-
cpe:2.3:a:versionize_project:versionize:0.1.2
-
cpe:2.3:a:versionize_project:versionize:0.1.3
-
cpe:2.3:a:versionize_project:versionize:0.1.4
-
cpe:2.3:a:versionize_project:versionize:0.1.5
-
cpe:2.3:a:versionize_project:versionize:0.1.6
-
cpe:2.3:a:versionize_project:versionize:0.1.7
-
cpe:2.3:a:versionize_project:versionize:0.1.8
-
cpe:2.3:a:versionize_project:versionize:0.1.9