CVE-2025-55159: slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
Impact
The getdisjointmut method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes.
Patches
This has been fixed in slab v0.4.11.
Workarounds
Avoid using getdisjointmut with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later.
References
- https://github.com/tokio-rs/slab/pull/152
Other sources
slab allows out-of-bounds access in getdisjointmut due to incorrect bounds check
— Microsoft
slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the getdisjointmut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using getdisjointmut with indices that might be beyond the slab's actual length.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55159?
CVE-2025-55159 is classified as a vulnerability that can lead to undefined behavior or potential crashes.
How do I fix CVE-2025-55159?
You can fix CVE-2025-55159 by upgrading to slab version 0.4.11 or later.
What is the impact of CVE-2025-55159?
The impact of CVE-2025-55159 is that it may allow access to uninitialized memory due to incorrect index checks.
Which versions of slab are affected by CVE-2025-55159?
CVE-2025-55159 affects slab version 0.4.10.
What method in slab is associated with CVE-2025-55159?
The vulnerability is associated with the `get_disjoint_mut` method in slab.