medium4.5
CVE-2023-53156
transpose: Buffer overflow due to integer overflow
Impact
Given the function `transpose::transpose`: ```rust fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize) ``` The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`. As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode. Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | transpose | >= 0.1.0, < 0.2.3 | 0.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ejmahler | Transpose | from 0.1.0 before 0.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://crates.io/crates/transpose
- https://github.com/advisories/GHSA-5gmm-6m36-r7jh
- https://github.com/ejmahler/transpose/issues/11
- https://rustsec.org/advisories/RUSTSEC-2023-0080.html
- https://github.com/ejmahler/transpose/commit/c4bcd39fabca9a31a401d0cc42d4090869b5a37a
- https://nvd.nist.gov/vuln/detail/CVE-2023-53156