Out-of-bounds Read Affecting xmas-elf package, versions <0.10.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-XMASELF-9689911
- published14 Apr 2025
- disclosed26 Mar 2025
- creditDONGYEON YU
Introduced: 26 Mar 2025
New CVE NOT AVAILABLE CWE-125 (opens in a new tab)How to fix?
Upgrade xmas-elf to version 0.10.0 or higher.
Overview
xmas-elf is a library for parsing and navigating ELF data; zero-allocation, type-safe.
Affected versions of this package are vulnerable to Out-of-bounds Read due to improper validation of the index argument against the bucket_count and chain_count fields in the context of the ELF section size. An attacker can trigger out-of-bounds reads by manipulating these fields to exceed the bounds of the hash table section, coupled with out-of-bounds hash table indexes in the ELF file.