{"id":"GHSA-cvmj-47v9-35m9","aliases":["RUSTSEC-2021-0154"],"status":"published","title":"FUSE-Rust: Uninitalized memory read and leak caused by fuser crate","description":"During the creation of a new libfuse session with `fuse_session_new`, the operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2021-09-10T12:00:00Z","modified":"2025-10-28T06:29:24Z","fixes":[{"ecosystem":"crates.io","package":"fuser","fixed_in":["0.16.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"fuser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fuser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.16.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"fuser","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.16.0"}]}]}],"references":[{"url":"https://github.com/cberner/fuser/pull/390","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0154.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cvmj-47v9-35m9"},{"url":"https://github.com/cberner/fuser","tags":["package"]},{"url":"https://crates.io/crates/fuser","tags":["package"]},{"url":"https://github.com/libfuse/libfuse/pull/1330","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-cvmj-47v9-35m9","title":"FUSE-Rust: Uninitalized memory read and leak caused by fuser crate","description":"During the creation of a new libfuse session with `fuse_session_new`, the operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so.","status":"published","published":"2025-09-15T17:30:21Z","modified":"2025-09-15T17:30:22Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"osv":[{"id":"GHSA-cvmj-47v9-35m9","title":"FUSE-Rust: Uninitalized memory read and leak caused by fuser crate","description":"During the creation of a new libfuse session with `fuse_session_new`, the operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so.","status":"published","published":"2025-09-15T17:30:21Z","modified":"2025-10-28T06:29:24.209631Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"RUSTSEC-2021-0154","title":"Uninitalized memory read \u0026 leak caused by fuser crate","description":"During creation of new libfuse session with `fuse_session_new` operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so","status":"published","published":"2021-09-10T12:00:00Z","modified":"2025-10-28T06:29:24.209631Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}