Read the docs
TI-2024-39118 Aliases GHSA-3qx8-rv27-j6gp

Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device`

Priority LOW 38CWE-843Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

An issue was identified in the `VmFd::create_device function`, leading to undefined behavior and miscompilations on rustc 1.82.0 and newer due to the function's violation of Rust's pointer safety rules. The function downcasted a mutable reference to its `struct kvm_create_device` argument to an immutable pointer, and then proceeded to pass this pointer to a mutating system call. Rustc 1.82.0 and newer elides subsequent reads of this structure's fields, meaning code will not see the value written by the kernel into the `fd` member. Instead, the code will observe the value that this field was initialized to prior to calling `VmFd::create_device` (usually, 0). The issue started in kvm-ioctls 0.1.0 and was fixed in 0.19.1 by correctly using a mutable pointer.

Why it matters now

Fix Fixed kvm-ioctls (crates.io): 0.19.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—kvm-ioctls (crates.io)before 0.19.10.19.1Patch availableGHSA-3qx8-rv27-j6gp
  • kvm-ioctls (crates.io) Vendor— Affected before 0.19.1 Fixed in 0.19.1 Patch available GHSA-3qx8-rv27-j6gp

Remediation

  • Fix · GHSA-3qx8-rv27-j6gp kvm-ioctls (crates.io) Fixed in 0.19.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-3qx8-rv27-j6gp

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences