CVE-2019-25004

CRITICAL9.8EPSS 0.17%

Unsound `impl Follow for bool`

Published: 8/25/2021Modified: 11/8/2023

Also known as:GHSA-gx73-2498-r55cRUSTSEC-2019-0028

Description

The implementation of `impl Follow for bool` allows to reinterpret arbitrary bytes as a `bool`. In Rust `bool` has stringent requirements for its in-memory representation. Use of this function allows to violate these requirements and invoke undefined behaviour in safe code.

Affected packages (2)

crates.io/flatbuffers>= 0.4.0, < 0.6.1
crates.io/flatbuffers>= 0.4.0, < 0.6.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-25004
PATCHhttps://crates.io/crates/flatbuffers
PATCHhttps://github.com/google/flatbuffers
WEBhttps://github.com/google/flatbuffers/issues/5530
WEBhttps://rustsec.org/advisories/RUSTSEC-2019-0028.html