Most recent entries from all

EUVD-2026-218393

fkie_cve-2023-28448

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

GHSA-8vxc-r5wp-vgvc — Versionize::deserialize implementation for FamStructWrapper is lacking bound checks, potentially leading to out of b…

Affected: crates.io: versionize

### Impact

An issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses.

### Patches

The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

### Workarounds \-

### References - https://github.com/firecracker-microvm/versionize/pull/53

gsd-2023-28448

msrc_CVE-2023-28448 — Versionize is lacking bound checks potentially leading to out of bounds memory access

msrc_CVE-2023-28448

RUSTSEC-2023-0030 — `Versionize::deserialize` implementation for `FamStructWrapper` is lacking bound checks, potentially leading to out…

Affected: crates.io: versionize

An issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.