RUSTSEC-2024-0408: 
Rust vulnerability analysis and mitigation

RUSTSEC-2024-0408 is a vulnerability in the rust-pprof library that involves unsound implementation related to slice creation from unaligned pointers. The issue affects rust-pprof versions up to 0.13.0-5 (Debian Tracker).

The vulnerability stems from unsafe code in the collector.rs file where file_vec (aligned to 1 byte) is cast to a specified type through slice::from_raw_parts. When elements aligned to more than 1 byte are added to the Collector, an unaligned pointer is created and used to build the slice, violating the safety guarantees of slice::from_raw_parts. Additionally, the addr_validate::validate public API can cause uninitialized memory exposure by allowing arbitrary types to be cast to c_void (GitHub Issue).

The vulnerability can lead to undefined behavior and potential memory safety violations when working with unaligned pointers. This can result in program crashes, particularly noticeable in debug builds on recent Rust compiler versions where the unsafe precondition violations are detected (GitHub Issue).

The issue can be triggered by normal usage of the library when working with data types that have alignment requirements greater than 1 byte. A proof-of-concept example demonstrates the vulnerability using a u16 type (aligned to 2 bytes) with the Collector (GitHub Issue).