RUSTSEC-2021-0013: Soundness issues in `raw-cpuid`

What to do

1. See which version you have: cargo tree -i raw-cpuid (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p raw-cpuid. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example raw-cpuid = "9.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Undefined behavior in as_string() methods

VendorInfo::as_string(), SoCVendorBrand::as_string(), and ExtendedFunctionInfo::processor_brand_string() construct byte slices using std::slice::from_raw_parts(), with data coming from #[repr(Rust)] structs. This is always undefined behavior.

See https://github.com/gz/rust-cpuid/issues/40.

This flaw has been fixed in v9.0.0, by making the relevant structs #[repr(C)].

native_cpuid::cpuid_count() is unsound

native_cpuid::cpuid_count() exposes the unsafe __cpuid_count() intrinsic from core::arch::x86 or core::arch::x86_64 as a safe function, and uses it internally, without checking the safety requirement:

> The CPU the program is currently running on supports the function being > called.

CPUID is available in most, but not all, x86/x86_64 environments. The crate compiles only on these architectures, so others are unaffected.

This issue is mitigated by the fact that affected programs are expected to crash deterministically every time.

See https://github.com/gz/rust-cpuid/issues/41.

The flaw has been fixed in v9.0.0, by intentionally breaking compilation when targeting SGX or 32-bit x86 without SSE. This covers all affected CPUs.

References

• Package: crates.io/crates/raw-cpuid
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0013.html
• Web: github.com/RustSec/advisory-db/pull/614

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for raw-cpuid

• VulnerabilityRUSTSEC-2021-0089 · 2021-01-20Optional `Deserialize` implementations lacking validation

Full security history of raw-cpuid