Listen to this Post
How GHSA-qwgh-2vcv-g2f7 Works
This vulnerability resides in the `block_buffer` crate, a foundational library used by many Rust cryptographic hashing implementations (like SHA-2, SHA-3, BLAKE2, etc.). The issue stems from a violation of internal invariants following a caught panic, which can lead to out-of-bounds memory access.
The `EagerBuffer` and `ReadBuffer` types store their internal cursor position (pos) inline within the data buffer itself. The `EagerBuffer` stores its cursor in the last byte of its internal block. When its `digest_blocks` method completes a partial block, it overwrites this cursor byte with input data before invoking a user-provided `compress` callback.
The `ReadBuffer` stores its cursor in buffer
</code>. Its `write_block` method gives a user-provided `gen_block` closure mutable access to the entire internal buffer before restoring `buffer[bash]` to a valid cursor. In both cases, if the user-provided callback (<code>compress</code> or <code>gen_block</code>) panics, the panic can be caught by safe code using <code>std::panic::catch_unwind</code>. However, after the panic, the cursor byte is left in a corrupted state, no longer satisfying the internal invariant that <code>pos < block_size</code>. Subsequent calls to `get_pos` on the corrupted buffer will read this invalid cursor value. The code assumes this value is always valid and uses `unreachable_unchecked!()` to inform the compiler of this invariant. When the invariant is broken, `get_pos` reaches this `unreachable_unchecked!()` call, which is undefined behavior (UB). In practice, this can manifest as out-of-bounds reads or writes, potentially leading to memory corruption. While the overwriting byte can come from untrusted input and is attacker-controlled, the exploitability depends on surrounding code catching the panic and continuing execution, which is uncommon. The attacker would also need a way to trigger a panic in the relevant callback. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: Rust/crates.io Version: < 0.12.1 Vulnerability: Buffer Corruption Severity: Critical date: 2026-08-19 <h2 style="color: blue;">Prediction: 2026-08-20</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] Check if your project uses the vulnerable block_buffer crate cargo tree | grep block_buffer Check the version in Cargo.toml grep block_buffer Cargo.toml
Exploit: (Educational Purposes!)
// This test, when run under Miri, triggers the UB, demonstrating the vulnerability.
// It shows how a caught panic can corrupt the internal cursor.
[cfg(miri)]
[bash]
fn exploit_eager_buffer_corruption() {
use block_buffer::EagerBuffer;
use generic_array::typenum::U4;
let mut buf = EagerBuffer::<U4>::new(&[1, 2]);
let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
// The compress callback panics, corrupting the cursor position.
buf.digest_blocks(&[3, 0xff], |_| panic!("simulated panic"));
}));
// The following call reaches unreachable_unchecked!() due to the corrupted cursor.
let _ = buf.get_pos(); // Undefined Behavior!
}
Protection:
- Upgrade: Immediately update the `block_buffer` crate to version 0.12.1 or later.
- Cargo Update: Run `cargo update -p block_buffer` to fetch the patched version.
- Audit: Use `cargo audit` to scan your project for this and other vulnerabilities.
Impact:
Successful exploitation can lead to out-of-bounds reads and writes. This can result in memory corruption, potentially allowing an attacker to read sensitive memory contents, cause a denial of service (application crash), or, in the worst case, achieve arbitrary code execution. The severity is amplified because the `block_buffer` crate is a dependency for many popular cryptographic libraries, making this a supply-chain risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
