{"id":"CVE-2023-28448","aliases":["AZL-25843","EUVD-2023-0952","GHSA-8vxc-r5wp-vgvc","RUSTSEC-2023-0030"],"status":"published","title":"Versionize is lacking bound checks, potentially leading to out of bounds memory access","description":"Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00556,"percentile":0.46623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-03-24T12:00:00Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"crates.io","package":"versionize","fixed_in":["0.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"cloud-hypervisor","fixed_in":["30.0-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"versionize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.1"},{"fixed":"0.1.10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cloud-hypervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"30.0-2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"versionize","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.1"},{"fixed":"0.1.10"}]}]},{"source":"osv","ecosystem":"crates.io","package":"versionize","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.1.10"}]}]}],"products":[{"vendor":"firecracker-microvm","product":"versionize"},{"vendor":"versionize_project","product":"versionize"}],"references":[{"url":"https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/firecracker-microvm/versionize/pull/53","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","fix","web"]},{"url":"https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28448","tags":["web","advisory"]},{"url":"https://github.com/firecracker-microvm/versionize/releases/tag/v0.1.10","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0030.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8vxc-r5wp-vgvc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28448.json","tags":["advisory"]},{"url":"https://github.com/firecracker-microvm/versionize","tags":["package"]},{"url":"https://crates.io/crates/versionize","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-28448","title":"Versionize is lacking bound checks, potentially leading to out of bounds memory access","description":"Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.\n","status":"published","published":"2023-03-24T19:34:29.037Z","modified":"2025-02-19T20:26:23.804Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-0952","description":"Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.\n","status":"published","published":"2023-03-24T19:34:29Z","modified":"2025-02-19T20:26:23Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:26.792701Z"}],"ghsa":[{"id":"GHSA-8vxc-r5wp-vgvc","title":"Versionize::deserialize implementation for FamStructWrapper\u003cT\u003e is lacking bound checks, potentially leading to out of bounds memory accesses","description":"### Impact\n\nAn issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses.\n\n### Patches\n\nThe impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.\n\n### Workarounds\n\\-\n\n### References\n- https://github.com/firecracker-microvm/versionize/pull/53","status":"published","published":"2023-03-24T22:00:05Z","modified":"2023-03-27T22:03:47Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:48.905887Z"}],"nvd":[{"id":"CVE-2023-28448","description":"Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.\n","status":"published","published":"2023-03-24T20:15:15.613Z","modified":"2026-06-17T05:47:45.653Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"AZL-25843","title":"CVE-2023-28448 affecting package cloud-hypervisor for versions less than 30.0-2","description":"Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.\n","status":"published","published":"2023-03-24T20:15:15Z","modified":"2026-04-21T04:23:18.232752Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"CVE-2023-28448","title":"Versionize is lacking bound checks, potentially leading to out of bounds memory access","description":"Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.\n","status":"published","published":"2023-03-24T19:34:29.037Z","modified":"2026-10-28T02:30:39.664356558Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-8vxc-r5wp-vgvc","title":"Versionize::deserialize implementation for FamStructWrapper\u003cT\u003e is lacking bound checks, potentially leading to out of bounds memory accesses","description":"### Impact\n\nAn issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses.\n\n### Patches\n\nThe impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.\n\n### Workarounds\n\\-\n\n### References\n- https://github.com/firecracker-microvm/versionize/pull/53","status":"published","published":"2023-03-24T22:00:05Z","modified":"2023-11-08T04:12:11.444949Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"RUSTSEC-2023-0030","title":"`Versionize::deserialize` implementation for `FamStructWrapper\u003cT\u003e` is lacking bound checks, potentially leading to out of bounds memory accesses","description":"An issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.","status":"published","published":"2023-03-24T12:00:00Z","modified":"2023-11-08T04:12:11.444949Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:39.971022Z"}]}}