GHSA-pqpw-89w5-82v5: `simd-json-derive` vulnerable to `MaybeUninit` misuse
N/A
CVSS Score
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
-
Published
11/12/2024
Updated
11/12/2024
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
-
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| simd-json-derive | rust | < 0.12.0 | 0.12.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from unsafe usage of MaybeUninit in the derive macro's generated deserialization code. While exact line numbers aren't available, the advisory explicitly states the derive macro used an unsafe pattern of creating MaybeUninit structs, assuming initialization before proper field assignment. This pattern is fundamentally unsound in Rust as it can leave fields uninitialized while claiming initialization, leading to memory safety issues. The confidence is high because: 1) The advisory directly links this pattern to the UB 2) The fix removed MaybeUninit usage entirely 3) The issue manifests in release mode where optimizer assumptions about initialization are stricter.