GHSA-hfxp-p695-629x: abomonation transmutes &T to and from &[u8] without sufficient constraints
N/A
CVSS Score
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
-
Published
6/16/2022
Updated
6/13/2023
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
-
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| abomonation | rust | <= 0.7.3 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability centers around unsafe transmutation between Rust references and byte slices. The abomonation crate's core functionality relies on transmuting &T <-> &[u8] through functions like abomonate() (serialization) and decode() (deserialization). These functions: 1) Violate alignment requirements by creating potentially misaligned references 2) Assume stable Rust type layouts 3) Expose padding bytes and pointers. The advisory specifically mentions these transmutes as the vulnerability source, and the test suite failures under Miri confirm the alignment issues. These are the primary entry points for unsafe memory operations described in the vulnerability report.