tomprogrammer ascii out-of-bounds indexing in safe code

Executive brief

A vulnerability was found in the 'ascii' library for the Rust programming language, which is used to handle ASCII-only strings. Due to a coding error, the library could allow a program to access memory outside of its intended boundaries. This could lead to application crashes or unpredictable behavior in software that relies on this library to process text data.

Technical details

A memory safety vulnerability exists in the 'ascii' crate (Rust) due to the implementation of the `From<&mut AsciiStr>` trait for `&mut [u8]` and `&mut str`. These implementations allowed safe code to bypass standard Rust safety guarantees, potentially leading to out-of-bounds array indexing (CWE-119). An attacker or a malformed input could trigger an out-of-bounds read or write, resulting in a panic (denial of service) or memory corruption. The issue was resolved in version 0.9.3 by removing the problematic trait implementations.

Affected products

• tomprogrammer ascii >= 0.7.0, < 0.9.3

Timeline

• 2023-02-28: advisory: GitHub Advisory GHSA-mrrw-grhq-86gf published
• 2023-02-28: patched: Fixed in version 0.9.3

References

• https://api.github.com/users/RainSignal
• https://github.com/RainSignal
• https://api.github.com/users/RainSignal/gists%7B/gist_id%7D
• https://api.github.com/users/RainSignal/repos
• https://avatars.githubusercontent.com/u/101503193?v=4
• https://api.github.com/users/RainSignal/events%7B/privacy%7D