{"id":"GHSA-wfg4-322g-9vqv","aliases":["RUSTSEC-2023-0045"],"status":"published","title":"memoffset allows reading uninitialized memory","description":"memoffset allows attempt of reading data from address `0` with arbitrary type. This behavior is an undefined behavior because address `0` to `std::mem::size_of\u003cT\u003e` may not have valid bit-pattern with `T`. Old implementation dereferences uninitialized memory obtained from `std::mem::align_of`. Older implementation prior to it allows using uninitialized data obtained from `std::mem::uninitialized` with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for \"father\" that includes (directly or transitively) type that [does not allow to be uninitialized](https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html).\n\nThis flaw was corrected by using `std::ptr::addr_of` in \u003chttps://github.com/Gilnaa/memoffset/pull/50\u003e.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-06-21T12:00:00Z","modified":"2023-11-08T04:23:47Z","fixes":[{"ecosystem":"crates.io","package":"memoffset","fixed_in":["0.6.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"memoffset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"memoffset","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"memoffset","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.2"}]}]}],"references":[{"url":"https://github.com/Gilnaa/memoffset/issues/24","tags":["web","report"]},{"url":"https://github.com/Gilnaa/memoffset/pull/50","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0045.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wfg4-322g-9vqv"},{"url":"https://github.com/Gilnaa/memoffset","tags":["package"]},{"url":"https://crates.io/crates/memoffset","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-wfg4-322g-9vqv","title":"memoffset allows reading uninitialized memory","description":"memoffset allows attempt of reading data from address `0` with arbitrary type. This behavior is an undefined behavior because address `0` to `std::mem::size_of\u003cT\u003e` may not have valid bit-pattern with `T`. Old implementation dereferences uninitialized memory obtained from `std::mem::align_of`. Older implementation prior to it allows using uninitialized data obtained from `std::mem::uninitialized` with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for \"father\" that includes (directly or transitively) type that [does not allow to be uninitialized](https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html).\n\nThis flaw was corrected by using `std::ptr::addr_of` in \u003chttps://github.com/Gilnaa/memoffset/pull/50\u003e.\n","status":"published","published":"2023-06-21T22:06:29Z","modified":"2023-06-21T22:06:31Z","updated_at":"2026-11-02T14:36:55.184601Z"}],"osv":[{"id":"GHSA-wfg4-322g-9vqv","title":"memoffset allows reading uninitialized memory","description":"memoffset allows attempt of reading data from address `0` with arbitrary type. This behavior is an undefined behavior because address `0` to `std::mem::size_of\u003cT\u003e` may not have valid bit-pattern with `T`. Old implementation dereferences uninitialized memory obtained from `std::mem::align_of`. Older implementation prior to it allows using uninitialized data obtained from `std::mem::uninitialized` with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for \"father\" that includes (directly or transitively) type that [does not allow to be uninitialized](https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html).\n\nThis flaw was corrected by using `std::ptr::addr_of` in \u003chttps://github.com/Gilnaa/memoffset/pull/50\u003e.\n","status":"published","published":"2023-06-21T22:06:29Z","modified":"2023-11-08T04:23:47.381762Z","updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"RUSTSEC-2023-0045","title":"memoffset allows reading uninitialized memory","description":"memoffset allows attempt of reading data from address `0` with arbitrary type. This behavior is an undefined behavior because address `0` to `std::mem::size_of\u003cT\u003e` may not have valid bit-pattern with `T`. Old implementation dereferences uninitialized memory obtained from `std::mem::align_of`. Older implementation prior to it allows using uninitialized data obtained from `std::mem::uninitialized` with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for \"father\" that includes (directly or transitively) type that [does not allow to be uninitialized](https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html).\n\nThis flaw was corrected by using `std::ptr::addr_of` in \u003chttps://github.com/Gilnaa/memoffset/pull/50\u003e.","status":"published","published":"2023-06-21T12:00:00Z","modified":"2023-11-08T04:23:47.381762Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}