rustsec-2025-0167
Vulnerability from osv_rustsec
Published
2025-12-25 12:00
Modified
2026-08-10 19:33
Summary
`Bitmap::try_from(&[u8])` can create invalid values
Details

The TryFrom<&[u8]> implementation for Bitmap<SIZE> copies the input bytes into an uninitialized backing store and calls assume_init() without validating that the bytes form a valid value of the backing store type. For SIZE = 1 the backing store is a bool, so any input byte other than 0x00 or 0x01 produces an invalid value, which is immediate undefined behavior.

The AsMut<[u8]> implementation has the same problem, as it allows safe code to write invalid bit patterns into the backing store through the returned slice.

No fixed version is available, as the crate is unmaintained; its GitHub repository was archived by the owner on 2026-05-03.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-corruption"
        ],
        "cvss": null,
        "informational": "unsound"
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "bitmaps",
        "purl": "pkg:cargo/bitmaps"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The `TryFrom\u003c\u0026[u8]\u003e` implementation for `Bitmap\u003cSIZE\u003e` copies the input bytes\ninto an uninitialized backing store and calls `assume_init()` without\nvalidating that the bytes form a valid value of the backing store type. For\n`SIZE = 1` the backing store is a `bool`, so any input byte other than `0x00`\nor `0x01` produces an invalid value, which is immediate undefined behavior.\n\nThe `AsMut\u003c[u8]\u003e` implementation has the same problem, as it allows safe code\nto write invalid bit patterns into the backing store through the returned slice.\n\nNo fixed version is available, as the crate is unmaintained; its GitHub\nrepository was archived by the owner on 2026-05-03.",
  "id": "RUSTSEC-2025-0167",
  "modified": "2026-08-10T19:33:56Z",
  "published": "2025-12-25T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/bitmaps"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0167.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bodil/bitmaps/issues/35"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "`Bitmap::try_from(\u0026[u8])` can create invalid values"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.