search

rustsec / advisory-db

Security advisory database for Rust crates published through crates.io
https://rustsec.org
Other
902 stars 349 forks source link

flate2 has been creating a slice of uninitialized memory #2008

Closed KisaragiEffective closed 2 months ago

KisaragiEffective commented 2 months ago
tarcieri commented 2 months ago

@KisaragiEffective want to open a PR with an advisory?

KisaragiEffective commented 2 months ago

@tarcieri maybe I will, but I'm not going to claim, so feel free to take this if you want :)

Shnatsel commented 2 months ago

There is no evidence of the uninitialized memory ever being read from or otherwise exposed. And whether the mere existence of uninitialized u8 is acceptable or not was still being debated last time I checked.

So I don't think it warrants an advisory at this point.

We should file one later if either a read from uninit memory is demonstrated (as detected e.g. by Memory Sanitizer) or the Operational Semantics team comes to a conclusion on whether a slice of uninit u8 that is never read from is acceptable or not.

ChrisDenton commented 2 months ago

whether the mere existence of uninitialized u8 is acceptable or not

As noted by Manish on the issue, uninitialized memory is instantly UB.

Shnatsel commented 2 months ago

This is not clear-cut. There is no normative document specifying this is UB. The Rust team in charge of writing said document has this on their issue tracker: https://github.com/rust-lang/unsafe-code-guidelines/issues/346 - in particular, it mentions miri not prohibiting the existence of such references.

With the question not being clearly settled even theoretically, and especially with no evidence of any kind of real-world security issue, we're not going to publish an advisory for this and cause a great deal of churn for the whole ecosystem.

I do appreciate this issue report being filed and the problem being brought to our attention. But in this particular instance I do not believe a security advisory is warranted.