Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseRUSTSEC-2024-0429
RUSTSEC-2024-0429:
Rust vulnerability analysis and mitigation
Overview
RUSTSEC-2024-0429 is a vulnerability discovered in the glib Rust crate affecting versions prior to 0.20.0. The issue involves unsoundness in Iterator and DoubleEndedIterator implementations for glib::VariantStrIter, where passing an immutable reference to a function that mutates the data behind the pointer violates Rust's invariants (GTK-RS PR).
Technical details
The vulnerability stems from undefined behavior in the VariantStrIter::impl_get function where an immutable reference (&p) is passed to a function that mutates the data behind the pointer. This violation of Rust's invariants causes multiple tests in the test suite to crash when compiling with optimizations (either --release mode or with opt-level of 2 or 3) with recent Rust versions. The issue was particularly noticeable with nightly Rust builds (GTK-RS PR).
Impact
The vulnerability can lead to program crashes when the affected code is compiled with optimizations enabled. This affects applications using the glib crate versions prior to 0.20.0 that utilize the VariantStrIter implementation (GTK-RS PR).
Mitigation and workarounds
The vulnerability has been fixed in glib version 0.20.0. Users are advised to upgrade to this version or later to resolve the issue. The fix involves correcting the pointer handling in the VariantStrIter::impl_get implementation (GTK-RS PR).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management