Rust advisories / cyfs-base
Unsound MediumRUSTSEC-2023-0046 · cyfs-base
RUSTSEC-2023-0046: Misaligned pointer dereference in `ChunkId::new`
Short answercyfs-base has an API that can cause undefined behaviour from safe code: Misaligned pointer dereference in `ChunkId::new`. No fixed version yet.
| Crate | cyfs-base |
|---|---|
| Type | Unsound |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2023-06-15 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-g753-ghr7-q33w |
What to do
- Find who pulls it in:
cargo tree -i cyfs-base. - Avoid the affected API, or replace the crate.
Details from the advisory
The function ChunkId::new creates a misaligned pointer by casting mutable pointer of u8 slice which has alignment 1 to the mutable pointer of u32 which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function.
References
- Package: crates.io/crates/cyfs-base
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0046.html
- Report: github.com/buckyos/CYFS/issues/275
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?