TI-2022-07582 Aliases CVE-2022-23523 GHSA-52h2-m2cf-9jh6

rust-vmm linux-loader vulnerable to Out-of-bounds Read

LOW 24CWE-119Published 2022-12-13 · Updated 2025-04-18

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF headers to determine the offsets to read from. If those offsets point beyond the end of the file this could lead to Virtual Machine Monitors using the `linux-loader` crate entering an infinite loop if the ELF header of the kernel they are loading was modified in a malicious manner. This issue has been addressed in 0.8.1. The issue can be mitigated by ensuring that only trusted kernel images are loaded or by verifying that the headers do not point beyond the end of the file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00216 12th percentileScored 2026-11-07

Fix Fixed linux-loader (rust-vmm): 0.8.1linux-loader (crates.io): 0.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rust-vmm	linux-loader	before 0.8.1	0.8.1	Patch available	CNA
—	linux-loader (crates.io)	before 0.8.1	0.8.1	Patch available	GHSA-52h2-m2cf-9jh6

linux-loader Vendorrust-vmm Affected before 0.8.1 Fixed in 0.8.1 Patch available CNA
linux-loader (crates.io) Vendor— Affected before 0.8.1 Fixed in 0.8.1 Patch available GHSA-52h2-m2cf-9jh6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linux-loader_project:linux-loader::::::rust::*	before 0.8.1	Vulnerable	Linux-loader Project

cpe:2.3:a:linux-loader_project:linux-loader:*:*:*:*:*:rust:*:* Versions before 0.8.1 Vulnerable ·Linux-loader Project

Remediation

Fix · CNA linux-loader (rust-vmm) Fixed in 0.8.1
Fix · GHSA-52h2-m2cf-9jh6 linux-loader (crates.io) Fixed in 0.8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-23523
2026-10-03 Alias added: GHSA-52h2-m2cf-9jh6

References

Patch 1

https://github.com/rust-vmm/linux-loader/pull/125

Advisory 2

Other 2

TI-2023-27657 Out-of-bounds write in rust-vmm vmm-sys-util CVSS 3.1CRITICAL 9.8
TI-2023-21677 Default functions in VolatileMemory trait lack bounds checks in vm-memory CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences