*This advisory is also published as [RUSTSEC-2023-0074]
LowPublished Dec 14, 2023 · updated Dec 18, 2023
*This advisory is also published as [RUSTSEC-2023-0074](https://rustsec.org/advisories/RUSTSEC-2023-0074.html).* The `Ref` methods `into_ref`, `into_mut`, `into_slice`, and `into_slice_mut` are unsound and may allow safe code to exhibit undefined behavior when used with `Ref<B, T>` where `B` is [`cell::Ref`](https://doc.rust-lang.org/core/cell/struct.Ref.html) or [`cell::RefMut`](https://doc.rust-lang.org/core/cell/struct.RefMut.html). Note that these methods remain sound when used with `B` types other than `cell::Ref` or `cell::RefMut`. See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis. The current plan is to yank the affected versions soon. See https://github.com/google/zerocopy/issues/679 for more detail.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| zerocopy crates.io | < 0.2.9 | 0.2.9 |
| < 0.3.2 | 0.3.2 | |
| < 0.4.1 | 0.4.1 | |
| < 0.5.2 | 0.5.2 | |
| < 0.6.6 | 0.6.6 | |
| < 0.7.31 | 0.7.31 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Google advisories
All Google| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 42024 | Microsoft VSCode: XSS | High | No fix yet |
| Jan 32024 | PostgreSQL: Array Set Element Memory Corruption | High | See the advisory |
| Dec 152023 | Kakadu: JPX fragmented list vulnerability | High | No fix yet |
| Dec 142023 | Microsoft Edge: Arbitrary Perms | Medium | See the advisory |
| Nov 292023 | Envoy: ALTS Bug | Medium | See the advisory |
| Nov 162023 | Oracle VM VirtualBox: Integer Overflow Leading To Out-Of-Bounds Read in virtioNetR3CtrlMac | High | See the advisory |