`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

published 2024-01-02 2 y ago modified 2026-10-12 27 d ago also GHSA-875g-mfp6-g7f9 , RUSTSEC-2024-0002 , EUVD-2024-0293

cvss: 5.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the `FamStructWrapper::deserialize` implementation provided by the crate for `vmm_sys_util::fam::FamStructWrapper` can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array length. Mismatch in the lengths might allow out of bounds memory access through Rust-safe methods. The issue was corrected in version 0.12.0 by inserting a check that verifies the lengths of compared flexible arrays are equal for any deserialized header and aborting deserialization otherwise. Moreover, the API was changed so that header length can only be modified through Rust-unsafe code. This ensures that users cannot trigger out-of-bounds memory access from Rust-safe code.

Patch / fix

fixed in 2 distros 4 links 1

crates.io vmm-sys-util 0.12.0
rust-vmm vmm-sys-util 0.12.0

debian suse opensuse azure linux

rust-vmm-sys-util Debian 14, Debian 13 0.12.1-1

debian advisories DEBIAN-CVE-2023-50711

sevctl Linux Micro 6.0 0.4.3-2.1
aws-nitro-enclaves-cli SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.5 1.3.0~git1.db34c02-150400.3.6.1
aws-nitro-enclaves-cli SLE Module for Public Cloud 15 SP6, openSUSE Leap 15.6 1.3.0~git1.db34c02-150600.10.3.1
sevctl SLE Module for Server Applications 15 SP5, openSUSE Leap 15.5 0.4.3-150500.3.3.1

suse advisories SUSE-SU-2025:20071-1 SUSE-SU-2024:1984-1 SUSE-SU-2024:1966-1 SUSE-SU-2024:0250-1

sevctl openSUSE Tumbleweed 0.4.3-2.1
virtiofsd openSUSE Tumbleweed 1.10.1-1.1

opensuse advisories openSUSE-SU-2024:13624-1 openSUSE-SU-2024:13645-1

cloud-hypervisor CBL-Mariner 2.0 32.0-3

azure linux advisories AZL-32311

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/rust-vmm/vmm-sys-util@30172fc commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-50711 updated 2026-06-26 cvss 5.7

vmm-sys-util: out of bounds memory accesses

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-08-26)

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.7	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	5.7	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
OSV	3.1	5.7	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
crates.io	vmm-sys-util	>=0.5.0, <0.12.0	0.12.0

Affected products

rust-vmm vmm-sys-util

Classification

Weakness

CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary