Diesel: Possible unaligned data access for implementations of `SqliteAggregate`
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
Diesel allows to register custom aggregate SQL functions for SQLite via the `SqliteAggregate` interface. To store an instance of the custom aggregate processor Diesel relied on the `sqlite3_aggregate_context` function provided by sqlite. This function doesn't provide any guarantees about alignment of the returned allocation, which in turn can lead to problems if the type implementing requires a special alignment, e.g. via a custom `#[align(x)]` attribute on the type implementing this trait. This affects any user of `SqliteAggregate` that registers the custom aggregate function with an SQLite connection, while using a non-standard alignment on the type implementing this trait. ## Mitigation The preferred mitigation to the outlined problem is to update to a Diesel version 2.3.8 or newer, which includes fixes for the problem. ## Resolution Diesel now allocates the corresponding memory on Rust side to get a correctly aligned allocation.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | diesel (crates.io) | before 2.3.8 | 2.3.8 | Patch available | GHSA-q8x8-jrhj-fh9p |
- diesel (crates.io) Vendor— Affected before 2.3.8 Fixed in 2.3.8 Patch available GHSA-q8x8-jrhj-fh9p
Remediation
- Fix · GHSA-q8x8-jrhj-fh9p diesel (crates.io) Fixed in 2.3.8 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-q8x8-jrhj-fh9p
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences