Read the docs
TI-2022-26576 Aliases GHSA-8mv5-7x95-7wcf

`mopa` is technically unsound

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from GitHub.

Summary

The `mopa` crate redefines the deprecated `TraitObject` struct from `core::raw` like so: ```rust #[repr(C)] #[derive(Copy, Clone)] #[doc(hidden)] pub struct TraitObject { pub data: *mut (), pub vtable: *mut (), } ``` This is done to then transmute a reference to a trait object (`&dyn Trait` for any trait `Trait`) into this struct and retrieve the `data` field for the purpose of downcasting. This is used to implement `downcast_ref_unchecked()`, in terms of which `downcast_ref()` is also implemented. Same goes for mutable reference downcasting and `Box` downcasting. The Rust compiler explicitly reserves the right to change the memory layout of `&dyn Trait` for any trait `Trait`. The worst case scenario is that it swaps `data` and `vtable`, making an executable location breach and compromisation of ASLR possible, since reads from `data` would read `vtable` instead. Likewise, arbitrary code execution is also theoretically possible if reads of `vtable` generated by the compiler read `data` instead. While, as of Rust 1.52, this unsound assumption still holds true, updating the compiler may silently create UB in a crate which previously compiled and run without issues, compromising the security of builds which are believed to be reproducible. A potential strategy to resolve this has already been suggested in an issue on the GitHub repository of the crate.

Why it matters now

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—mopa (crates.io)up to 0.2.2—No fix listedGHSA-8mv5-7x95-7wcf
  • mopa (crates.io) Vendor— Affected up to 0.2.2 Fixed in — No fix listed GHSA-8mv5-7x95-7wcf

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-03 Threatist record created from GHSA-8mv5-7x95-7wcf

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences