CVE-2023-28448
📋 TL;DR
This vulnerability in the Versionize crate allows out-of-bounds memory accesses during deserialization of FamStructWrapper data structures. It affects Rust applications using versionize 0.1.1 through 0.1.9 for version-tolerant serialization. The issue could lead to memory corruption, crashes, or potential information disclosure.
💻 Affected Systems
- versionize crate
- Firecracker microVM
- Applications using versionize for serialization
📦 What is this software?
Versionize by Versionize Project
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, denial of service, or sensitive data exposure.
Likely Case
Application crashes, denial of service, or memory corruption errors.
If Mitigated
No impact if patched or if vulnerable code paths aren't triggered.
🎯 Exploit Status
Exploitation requires feeding malicious serialized data to vulnerable deserialization endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.10 and later
Vendor Advisory: https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
Restart Required: Yes
Instructions:
1. Update Cargo.toml to use versionize >=0.1.10
2. Run 'cargo update'
3. Rebuild and redeploy affected applications
4. Restart services using the updated crate
🔧 Temporary Workarounds
Input validation
allValidate and sanitize all serialized data before deserialization
Network isolation
allRestrict network access to services using vulnerable versionize versions
🧯 If You Can't Patch
- Implement strict input validation for all deserialization endpoints
- Isolate affected systems and monitor for crashes or memory errors
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for versionize dependency version 0.1.1 through 0.1.9Check Version:
grep versionize Cargo.toml && grep -A2 versionize Cargo.lockVerify Fix Applied:
Verify versionize >=0.1.10 in dependencies and check for absence of deserialization errors📡 Detection & Monitoring
Log Indicators:
- Segmentation faults
- Memory access violation errors
- Unexpected application crashes during deserialization
Network Indicators:
- Unusual traffic patterns to deserialization endpoints
- Large or malformed serialized data payloads
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "memory violation" OR "deserialization error")🔗 References
- https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47
- https://github.com/firecracker-microvm/versionize/pull/53
- https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
- https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47
- https://github.com/firecracker-microvm/versionize/pull/53
- https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
