-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unsafe usage of get_unchecked_mut in the CDFileStats::new implementation shown in the commit diff. Though the advisory mentions grcov::covdir::get_coverage, the actual vulnerable code resides in CDFileStats::new where coverage data processing occurs. The function calculates an index from line_num - 1 but fails to validate it against the lines vector bounds before unsafe mutation. The commit patch replaces get_unchecked_mut with safe get_mut with bounds checking, confirming this as the vulnerable location. High confidence comes from direct correlation between the vulnerability description, commit diff, and crash analysis in the bug report.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| grcov | rust | < 0.8.20 | 0.8.20 |