Versionize is lacking bound checks, potentially leading to out of bounds memory access
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-125 and the CVSS impact.
Summary
Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| firecracker-microvm | versionize | before 0.1.10 | 0.1.10 | Patch available | CNA |
| — | versionize (crates.io) | 0.1.1 to before 0.1.10 | 0.1.10 | Patch available | GHSA-8vxc-r5wp-vgvc |
- versionize Vendorfirecracker-microvm Affected before 0.1.10 Fixed in 0.1.10 Patch available CNA
- versionize (crates.io) Vendor— Affected 0.1.1 to before 0.1.10 Fixed in 0.1.10 Patch available GHSA-8vxc-r5wp-vgvc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:versionize_project:versionize:*:*:*:*:*:rust:*:* | 0.1.1 to before 0.1.10 | Vulnerable | Versionize Project |
- cpe:2.3:a:versionize_project:versionize:*:*:*:*:*:rust:*:* Versions 0.1.1 to before 0.1.10 Vulnerable ·Versionize Project
Remediation
- Fix · CNA versionize (firecracker-microvm) Fixed in 0.1.10
- Fix · GHSA-8vxc-r5wp-vgvc versionize (crates.io) Fixed in 0.1.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28448
- 2026-10-03 Alias added: GHSA-8vxc-r5wp-vgvc
References
Patch 1
Advisory 3
Sources
- CVE-2023-28448 · CVE Program
- CVE-2023-28448 · NVD
- FIRST EPSS
- GHSA-8vxc-r5wp-vgvc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences