Read the docs
TI-2023-30697 Aliases GHSA-5x36-7567-3cw6

partial_sort contains Out-of-bounds Read in release mode

Priority LOW 38CWE-125Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Affected versions of this crate were using a debug assertion to validate the `last` parameter of `partial_sort()`. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions. All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads. The accessible region is further limited by an initial bounds-checked read at `(last / 2) - 1`, i.e., it is proportional to the size of the vector. This bug has been fixed in v0.2.0.

Why it matters now

Fix Fixed partial_sort (crates.io): 0.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—partial_sort (crates.io)before 0.2.00.2.0Patch availableGHSA-5x36-7567-3cw6
  • partial_sort (crates.io) Vendor— Affected before 0.2.0 Fixed in 0.2.0 Patch available GHSA-5x36-7567-3cw6

Remediation

  • Fix · GHSA-5x36-7567-3cw6 partial_sort (crates.io) Fixed in 0.2.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-5x36-7567-3cw6

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences