Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to: Undefined behavior in asstring methods which use std::str::fromutf8unchecked internally. Panics due to failed...

alexcrichton-cranelift-native (>=0.52.0, <=0.53.0), alexcrichton-cranelift-simplejit (0.53.0) +153 more potentially affected by CVE-2021-45687 via raw-cpuid (>=3.1.0, <=8.1.2)

raw-cpuid CARGO version =3.1.0, =0.52.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =0.26.1, =0.6.2, =0.5.0, =0.2.0, =0.5.1 and more Source cves: CVE-2021-45687 Source advisory: OSV:GHSA-JF5H-CF95-W759...

GHSA-JF5H-CF95-W759 Optional `Deserialize` implementations lacking validation

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to: Undefined behavior in asstring methods which use std::str::fromutf8unchecked internally. Panics due to failed...

PT-2022-28885

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.16.3 through v5.16.5 Description The issue concerns a potential security vulnerability in the KVM Kernel-based Virtual Machine implementation for x86 architecture, specifically related to the handling of the kvm cpuid...

PT-2024-6125 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak in the KVM subsystem of the Linux kernel. The memory leak occurs due to the incorrect freeing of the kvm cpuid entry2 array. This can be exploited...

alexcrichton-cranelift-native (>=0.52.0, <=0.53.0), alexcrichton-cranelift-simplejit (0.53.0) +153 more potentially affected by CVE-2021-45687 via raw-cpuid (>=3.1.0, <=8.1.2)

raw-cpuid CARGO version =3.1.0, =0.52.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =0.26.1, =0.6.2, =0.5.0, =0.2.0, =0.5.1 and more Source cves: CVE-2021-45687 Source advisory: OSV:GHSA-W428-F65R-H4Q2...

GHSA-W428-F65R-H4Q2 Deserialization of Untrusted Data in rust-cpuid

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

Rust raw-cpuid crate has an unspecified vulnerability

Rust raw-cpuid crate is a library for parsing x86 CPUID instructions, written in rust, with no external dependencies. The implementation is very similar to the Intel CPUID manual description. The library only depends on libcore. versions prior to Rust raw-cpuid crate 9.1.1 have security...

CVE-2021-45687

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

CVE-2021-45687

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

CVE-2021-45687

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

Memory corruption

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

Rust raw-cpuid crate 输入验证错误漏洞

Rust raw-cpuid crate is a library for parsing x86 CPUID instructions, written in rust, with no external dependencies. The implementation is very similar to the Intel CPUID manual description. The library only depends on libcore. versions prior to Rust raw-cpuid crate 9.1.1 have security...

CVE-2021-45687

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

CVE-2021-45687

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

CVE-2021-45687

The CVE-2021-45687 issue affects the Rust raw-cpuid crate prior to 9.1.1. When the non-default serialize feature is enabled, Deserialize may lack sufficient validation, causing memory corruption or a panic. Versions before 9.1.1 are vulnerable; upgrading to 9.1.1 or later is the supported remedia...

CVE-2021-45687: Improper Input Validation

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used which is not the the default, a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic...

PT-2024-11410

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.13.1 and earlier Description The issue arises when ftrace is looping over a list of addresses to patch and fails when patching the function riscv cpuid to hartid mask. The patch text nosync function, after patching the...

Soundness issue in raw-cpuid

VendorInfo::asstring, SoCVendorBrand::asstring, and ExtendedFunctionInfo::processorbrandstring construct byte slices using std::slice::fromrawparts, with data coming from reprRust structs. This is always undefined behavior. This flaw has been fixed in v9.0.0, by making the relevant structs reprC...

GHSA-HVQC-PC78-X9WH Soundness issue in raw-cpuid

VendorInfo::asstring, SoCVendorBrand::asstring, and ExtendedFunctionInfo::processorbrandstring construct byte slices using std::slice::fromrawparts, with data coming from reprRust structs. This is always undefined behavior. This flaw has been fixed in v9.0.0, by making the relevant structs reprC...