{"id":"GHSA-3w8g-xr3f-2mp8","summary":"Out of bounds write in nalgebra","details":"The `Deserialize` implementation for `VecStorage` did not maintain the invariant that the number of elements must equal `nrows * ncols`. Deserialization of specially crafted inputs could allow memory access beyond allocation of the vector.\n\nThis flaw was introduced in v0.11.0 ([`086e6e`](https://github.com/dimforge/nalgebra/commit/086e6e719f53fecba6dadad2e953a487976387f5)) due to the addition of an automatically derived implementation of `Deserialize` for `MatrixVec`. `MatrixVec` was later renamed to `VecStorage` in v0.16.13 ([`0f66403`](https://github.com/dimforge/nalgebra/commit/0f66403cbbe9eeac15cedd8a906c0d6a3d8841f2)) and continued to use the automatically derived implementation of `Deserialize`.","aliases":["CVE-2021-38190","RUSTSEC-2021-0070"],"modified":"2023-11-08T04:06:25.921387Z","published":"2021-08-25T20:55:49Z","database_specific":{"cwe_ids":["CWE-119","CWE-787"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2021-08-18T21:30:58Z","nvd_published_at":"2021-08-08T06:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38190"},{"type":"WEB","url":"https://github.com/dimforge/nalgebra/issues/883"},{"type":"WEB","url":"https://github.com/dimforge/nalgebra/pull/889"},{"type":"WEB","url":"https://github.com/dimforge/nalgebra/commit/a803271fcce75b7c151e92aa099dfa546db4adc5"},{"type":"PACKAGE","url":"https://github.com/dimforge/nalgebra"},{"type":"WEB","url":"https://github.com/dimforge/nalgebra/blob/dev/CHANGELOG.md#0270"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2021-0070.html"}],"affected":[{"package":{"name":"nalgebra","ecosystem":"crates.io","purl":"pkg:cargo/nalgebra"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.27.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-3w8g-xr3f-2mp8/GHSA-3w8g-xr3f-2mp8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}