-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-sdk-base | rust | < 0.14.1 | 0.14.1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the RoomMember::normalized_power_level method in matrix-sdk-base. The description mentions that a panic can occur if a room member's power level is Int::Min. Analysis of the provided pull request and commits confirms this. The core of the issue is an integer overflow during the power level normalization calculation. Specifically, when the input power_level is Int::MIN, multiplying it by 100 causes an overflow, and the subsequent attempt to convert this value back to a ruma::Int using try_into() triggers a panic. The fixing commits first refactor the vulnerable logic into a new function normalize_power_level and then apply a fix by clamping the calculated value to a safe range of [0, 100] before the type conversion. Since normalize_power_level was not present in any released vulnerable version, the only externally accessible vulnerable function is RoomMember::normalized_power_level.
RustRustOngoing coverage of React2Shell