Security Digest · Critical advisory (no CVE assigned)
GHSA-5w5r-mf82-595p: Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema
The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::getrootunchecked, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.
CVSS 9.3 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
cargo audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| crates.io (Rust) | capnp | < 0.24.0 | 0.24.0 |
Details
The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::getrootunchecked, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.
Reader::get
StructSchema::new
This vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.
The issue is resolved in version 0.24.0 by making constructor functions unsafe and mark the fields of struct as visible only in the crate.
CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Sources and references
- GitHub Advisory GHSA-5w5r-mf82-595p github.com
- github.com github.com
- github.com github.com
- github.com github.com
- rustsec.org rustsec.org
Critical crates.io (Rust) advisories · Today’s Security Digest