GHSA-fp5x-7m4q-449f: Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer
N/A
Basic Information
Technical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| direct_ring_buffer | rust | < 0.2.2 | 0.2.2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability originates in the direct_ring_buffer::create_ring_buffer function. The original implementation allocated memory for the ring buffer but did not initialize it, which is a violation of Rust's safety rules when dealing with types that have validity invariants (e.g., bool must be 0 or 1). The functions direct_ring_buffer::Producer::write_slices and direct_ring_buffer::Consumer::read_slices are the primary vectors for triggering this vulnerability. They create typed slices (&mut [T] and &[T]) from the uninitialized memory, which leads to undefined behavior when these slices are accessed. The fix, applied in version 0.2.2, addresses the root cause by changing create_ring_buffer to use resize_with to fill the buffer with default values, thus ensuring that the memory is always initialized. Therefore, any runtime profile of an exploitation attempt would likely show calls to write_slices or read_slices operating on a buffer created by the vulnerable version of create_ring_buffer.
Vulnerable functions
direct_ring_buffer::create_ring_buffersrc/lib.rs
direct_ring_buffer::Producer::write_slicessrc/lib.rs
direct_ring_buffer::Consumer::read_slicessrc/lib.rs