Vulnerability-Lookup

rustsec-2025-0107

Vulnerability from osv_rustsec

Published

2025-10-21 12:00

Modified

2025-10-28 06:02

Summary

Uninitialized memory exposure in any_as_u8_slice

Details

The safe function any_as_u8_slice can create byte slices that reference uninitialized memory when used with types containing padding bytes.

The function uses slice::from_raw_parts to create a &[u8] covering the entire size of a type, including padding bytes. According to Rust's documentation, from_raw_parts requires all bytes to be properly initialized, but padding bytes in structs are not guaranteed to be initialized. This violates the safety contract and causes undefined behavior.

References

URL

Type

	https://crates.io/crates/borrowck_sacrifices	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2025-0107.html	ADVISORY
	https://github.com/alexpyattaev/borrowck_sacrific…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-exposure"
        ],
        "cvss": null,
        "informational": "unsound"
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "borrowck_sacrifices::unsafe_casts::any_as_u8_slice"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "borrowck_sacrifices",
        "purl": "pkg:cargo/borrowck_sacrifices"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.2.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-xcpm-76hf-c9cc"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The safe function `any_as_u8_slice` can create byte slices that reference uninitialized memory when used with types containing padding bytes.\n\nThe function uses `slice::from_raw_parts` to create a `\u0026[u8]` covering the entire size of a type, including padding bytes. According to Rust\u0027s documentation, `from_raw_parts` requires all bytes to be properly initialized, but padding bytes in structs are not guaranteed to be initialized. This violates the safety contract and causes undefined behavior.",
  "id": "RUSTSEC-2025-0107",
  "modified": "2025-10-28T06:02:18Z",
  "published": "2025-10-21T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/borrowck_sacrifices"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0107.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/alexpyattaev/borrowck_sacrifices/issues/1"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Uninitialized memory exposure in any_as_u8_slice"
}

GHSA-XCPM-76HF-C9CC

Vulnerability from github – Published: 2025-10-22 16:35 – Updated: 2025-10-22 16:35

Summary

Borrowck Scarifices exposes uninitialized memory in any_as_u8_slice

Details

The safe function any_as_u8_slice can create byte slices that reference uninitialized memory when used with types containing padding bytes.

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "borrowck_sacrifices"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-824"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-22T16:35:08Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "The safe function `any_as_u8_slice` can create byte slices that reference uninitialized memory when used with types containing padding bytes.\n\nThe function uses `slice::from_raw_parts` to create a `\u0026[u8]` covering the entire size of a type, including padding bytes. According to Rust\u0027s documentation, `from_raw_parts` requires all bytes to be properly initialized, but padding bytes in structs are not guaranteed to be initialized. This violates the safety contract and causes undefined behavior.",
  "id": "GHSA-xcpm-76hf-c9cc",
  "modified": "2025-10-22T16:35:08Z",
  "published": "2025-10-22T16:35:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/alexpyattaev/borrowck_sacrifices/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alexpyattaev/borrowck_sacrifices/commit/1bdaa14da68a6e8207f9e81359116f53139800f2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alexpyattaev/borrowck_sacrifices"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0107.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Borrowck Scarifices exposes uninitialized memory in any_as_u8_slice"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.