RUSTSEC-2023-0056: Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses

What to do

1. See which version you have: cargo tree -i vm-memory (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p vm-memory. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example vm-memory = "0.12.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

An issue was discovered in the default implementations of the VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref} trait functions, which allows out-of-bounds memory access if the VolatileMemory::get_slice function returns a VolatileSlice whose length is less than the function’s count argument. No implementations of get_slice provided in vm_memory are affected. Users of custom VolatileMemory implementations may be impacted if the custom implementation does not adhere to get_slice's documentation.

The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the VolatileSlice returned by get_slice is of the correct length.

References

• Package: crates.io/crates/vm-memory
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0056.html
• Report: github.com/rust-vmm/vm-memory/issues/250
• Web: github.com/rust-vmm/vm-memory/commit/aff1dd4a5259f7deba56692840f7a2d9ca34c9c8

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for vm-memory

• Vulnerability HighRUSTSEC-2020-0157 · 2020-06-02Improper Synchronization and Race Condition in vm-memory

Full security history of vm-memory