GHSA-5x36-7567-3cw6: Partial sort Partial_sort Contains Out-of-bounds Read Vulnerability

MODERATE
Share
CWE-125
Published
Advisory Summary

GHSA-5x36-7567-3cw6 is a MODERATE partial_sort contains out-of-bounds read vulnerability (CWE-125: Out-of-bounds Read) affecting Partial sort libraries in the crates.io ecosystem. The issue involves partial_sort contains out-of-bounds read in release mode. Remediation is available by upgrading affected packages to version 0.2.0.

GHSA-5x36-7567-3cw6 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-5x36-7567-3cw6
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-125: Out-of-bounds Read
Affected Product Partial sort
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-5x36-7567-3cw6

To remediate this vulnerability, upgrade all affected Partial sort dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

partial_sort fixed: 0.2.0 
Upgrade partial_sort to 0.2.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for partial_sort

How to Check if You Are Affected

To determine whether your application is affected by GHSA-5x36-7567-3cw6, inspect your project dependencies for Partial sort:

inspect dependencies for partial_sort

Analyze the terminal output to locate any version of Partial sort in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.2.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In Partial sort, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Affected versions of this crate were using a debug assertion to validate the `last` parameter of `partial_sort()`. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions. All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads. The accessible region is further limited by an initial bounds-checked read at `(last / 2) - 1`, i.e., it is proportional to the size of the vector. This bug has been fixed in v0.2.0.

GHSA-5x36-7567-3cw6 Affected Partial sort Versions

1 component(s)
Fixed Versions:
0.2.0
Product / Package Ecosystem Affected Versions Fixed Version
partial_sort
 crates.io
< 0.2.0
0.2.0

References

Partial sort Source Repository REPOSITORY
https://github.com/sundy-li/partial_sort/issues/7
Partial sort Source Repository REPOSITORY
https://github.com/sundy-li/partial_sort
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2023-0016.html

Frequently Asked Questions

What is GHSA-5x36-7567-3cw6?
GHSA-5x36-7567-3cw6 is a security vulnerability in Partial sort involving partial_sort contains Out-of-bounds Read in release mode under CWE-125: Out-of-bounds Read.
Which Partial sort versions are affected?
Affected versions include releases prior to 0.2.0 across affected packages: partial_sort.
What version fixes GHSA-5x36-7567-3cw6?
Upgrading to 0.2.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is partial_sort affected?
Yes, partial_sort is affected in releases prior to 0.2.0. Upgrade your dependency to 0.2.0 or later.
What CWE is associated with GHSA-5x36-7567-3cw6?
GHSA-5x36-7567-3cw6 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check crates.io dependencies for GHSA-5x36-7567-3cw6?
Run the dependency tree command: 'inspect dependencies for partial_sort'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5x36-7567-3cw6",
  "modified" : "2023-02-28T20:31:05Z",
  "published" : "2023-02-28T20:31:05Z",
  "aliases" : [ ],
  "summary" : "partial_sort contains Out-of-bounds Read in release mode",
  "details" : "Affected versions of this crate were using a debug assertion to validate the `last` parameter of `partial_sort()`. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.\n\nAll writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.\n\nThe accessible region is further limited by an initial bounds-checked read at `(last / 2) - 1`, i.e., it is proportional to the size of the vector.\n\nThis bug has been fixed in v0.2.0.\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "partial_sort"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/sundy-li/partial_sort/issues/7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/sundy-li/partial_sort"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2023-0016.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-02-28T20:31:05Z",
    "nvd_published_at" : null
  }
}