
Cloud Vulnerability DB
A community-led vulnerabilities database
A vulnerability (RUSTSEC-2024-0407) was discovered in the Rust linkme crate where type coercion could bypass the DistributedSlice typecheck mechanism. The issue was identified on March 6, 2024, affecting the distributed slice functionality of the crate (GitHub Issue).
The vulnerability allows for type coercion to bypass the DistributedSlice typecheck functionality. Specifically, DistributedSlice::private_typecheck(self, T) accepts an argument of type &&str and incorrectly coerces it to &str, potentially leading to memory safety issues. In the proof of concept, this could result in accessing an invalid memory range spanning up to 140 TB (GitHub Issue).
When exploited, this vulnerability could lead to memory safety violations and potential undefined behavior in Rust programs using the linkme crate. The issue could allow access to invalid memory ranges, potentially causing security implications for applications relying on the affected functionality (GitHub Issue).
A proof of concept exists demonstrating the vulnerability through a simple code example using distributed slices with mismatched reference types. The exploit can be triggered by creating a distributed slice with &&str elements when &str is expected (GitHub Issue).
The issue was addressed and fixed on March 6, 2024, through a pull request that prevents coercion before the distributed slice typecheck (GitHub Issue).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."