CVE-2023-53156: Integer Overflow
Given the function transpose::transpose: rust fn transpose<T: Copy>(input: &[T], output: &mut [T], inputwidth: usize, inputheight: usize)
The safety check inputwidth inputheight == output.len() can fail due to inputwidth inputheight overflowing in such a way that it equals output.len(). As a result of failing the safety check, memory past the end of output is written to. This only occurs in release mode since panics on overflow in debug mode.
Exploiting this issue requires the caller to pass inputwidth and inputheight arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.
Other sources
The transpose crate before 0.2.3 for Rust allows an integer overflow via inputwidth and inputheight arguments.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53156?
CVE-2023-53156 has been classified as a vulnerability that can lead to integer overflow, which may affect application reliability.
How do I fix CVE-2023-53156?
To fix CVE-2023-53156, update the transpose crate to version 0.2.3 or later.
What input parameters are involved in CVE-2023-53156?
CVE-2023-53156 involves potential integer overflow via the input_width and input_height parameters.
Which versions of the transpose crate are affected by CVE-2023-53156?
Versions of the transpose crate prior to 0.2.3 are affected by CVE-2023-53156.
What programming language does CVE-2023-53156 pertain to?
CVE-2023-53156 pertains to the Rust programming language.