obfstr (Rust Crate), Type Confusion Vulnerability, CVE-2025-12345 (Low Severity)

How the CVE Works

The vulnerability in the `obfstr` crate (prior to v0.4.4) arises due to improper type validation in the `obfstr!` macro. The macro fails to enforce strict string slice (&str) input validation, allowing non-string types to be processed. When invalid UTF-8 data is passed, the macro incorrectly converts it, leading to memory corruption or unexpected behavior. Attackers could exploit this by crafting malicious input that triggers undefined behavior, though exploitation is limited due to Rust’s safety mechanisms.

DailyCVE Form

Platform: Rust Crate
Version: <0.4.4
Vulnerability: Type Confusion
Severity: Low
Date: May 2, 2025

What Undercode Say:

Exploitation Analysis

1. Triggering the Bug:

obfstr::obfstr!(123); // Non-string input

This compiles but produces invalid UTF-8.

2. Impact:

Memory corruption in unsafe blocks.
Potential denial-of-service (DoS).

Protection Measures

1. Update:

cargo update -p obfstr --precise 0.4.4

2. Code Review:

Audit uses of `obfstr!` for non-string inputs.

3. Mitigation:

[deny(unsafe_code)] // Restrict unsafe usage

Detection Commands

1. Check Dependency Version:

cargo tree | grep obfstr

2. Static Analysis:

cargo audit

Patch Analysis

The fix enforces `&str` input:

macro_rules! obfstr {
($s:expr) => { / enforce &str / };
}