TI-2024-29400 Aliases CVE-2024-43806 GHSA-c827-hfw6-qwvm

`rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion

MEDIUM 62CWE-400Published 2024-08-26 · Updated 2024-08-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in `rustix::fs::Dir::read_more`, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. The symptoms were initially discovered in https://github.com/imsnif/bandwhich/issues/284. That post has lots of details of our investigation. Full details can be read on the GHSA-c827-hfw6-qwvm repo advisory. If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the `Dir` iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. As an example, Linux's various virtual file systems (e.g. `/proc`, `/sys`) can contain directories that spontaneously pop in and out of existence. Attempting to iterate over them using `rustix::fs::Dir` directly or indirectly (e.g. with the `procfs` crate) can trigger this fault condition if the implementation decides to continue on errors. An attacker knowledgeable about the implementation details of a vulnerable target can therefore try to trigger this fault condition via any one or a combination of several available APIs. If successful, the application host will quickly run out of memory, after which the application will likely be terminated by an OOM killer, leading to denial of service. This issue has been addressed in release versions 0.35.15, 0.36.16, 0.37.25, and 0.38.19. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0048 41st percentileScored 2026-11-07

Fix Fixed rustix (bytecodealliance): 0.35.15, 0.36.16, 0.37.25 +1rustix (crates.io): 0.35.15, 0.36.16, 0.37.25 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bytecodealliance	rustix	0.35.11 to before 0.35.15; 0.36.0 to before 0.36.16; 0.37.0 to before 0.37.25; 0.38.0 to before 0.38.19	0.35.15, 0.36.16, 0.37.25, 0.38.19	Patch available	CNA
—	rustix (crates.io)	0.35.11 to before 0.35.15	0.35.15	Patch available	GHSA-c827-hfw6-qwvm
—	rustix (crates.io)	0.36.0 to before 0.36.16	0.36.16	Patch available	GHSA-c827-hfw6-qwvm
—	rustix (crates.io)	0.37.0 to before 0.37.25	0.37.25	Patch available	GHSA-c827-hfw6-qwvm
—	rustix (crates.io)	0.38.0 to before 0.38.19	0.38.19	Patch available	GHSA-c827-hfw6-qwvm

rustix Vendorbytecodealliance Affected 0.35.11 to before 0.35.15; 0.36.0 to before 0.36.16; 0.37.0 to before 0.37.25; 0.38.0 to before 0.38.19 Fixed in 0.35.15, 0.36.16, 0.37.25, 0.38.19 Patch available CNA
rustix (crates.io) Vendor— Affected 0.35.11 to before 0.35.15 Fixed in 0.35.15 Patch available GHSA-c827-hfw6-qwvm
rustix (crates.io) Vendor— Affected 0.36.0 to before 0.36.16 Fixed in 0.36.16 Patch available GHSA-c827-hfw6-qwvm
rustix (crates.io) Vendor— Affected 0.37.0 to before 0.37.25 Fixed in 0.37.25 Patch available GHSA-c827-hfw6-qwvm
rustix (crates.io) Vendor— Affected 0.38.0 to before 0.38.19 Fixed in 0.38.19 Patch available GHSA-c827-hfw6-qwvm

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:bytecodealliance:rustix::::::::	—	—	bytecodealliance

cpe:2.3:a:bytecodealliance:rustix:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance

Remediation

Fix · CNA rustix (bytecodealliance) Fixed in 0.35.15, 0.36.16, 0.37.25, 0.38.19
Fix · GHSA-c827-hfw6-qwvm rustix (crates.io) Fixed in 0.35.15 Advisory →
Fix · GHSA-c827-hfw6-qwvm rustix (crates.io) Fixed in 0.36.16 Advisory →
Fix · GHSA-c827-hfw6-qwvm rustix (crates.io) Fixed in 0.37.25 Advisory →
Fix · GHSA-c827-hfw6-qwvm rustix (crates.io) Fixed in 0.38.19 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-43806
2026-10-03 Alias added: GHSA-c827-hfw6-qwvm

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-43806

Other 9

TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9

See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences