CVE-2023-28445: Deno improperly handles resizable ArrayBuffer
10
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.51421%
CWE
Published
3/23/2023
Updated
5/4/2023
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
Deno | rust | = 1.32.0 | 1.32.1 |
serde_v8 | rust | = 0.87.0 | 0.88.0 |
deno_runtime | rust | = 0.102.0 | 0.103.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from improper handling of resizable ArrayBuffers in async contexts. The core issue was in serde_v8's V8Slice implementation, which provided direct buffer access without revalidating the BackingStore's length after potential resizing. The patches in denoland/deno#18452 explicitly modified these methods to check the current buffer length and truncate slices when necessary. This indicates the original implementations of V8Slice::open and V8Slice::open_mut were vulnerable to OOB access when buffers were resized during async operations, as they relied on initial length values rather than current state.