Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bump vm-memory and vmm-sys-util versions due to RUSTSEC warnings #1647

Open
mythi opened this issue Nov 20, 2024 · 0 comments
Open

bump vm-memory and vmm-sys-util versions due to RUSTSEC warnings #1647

mythi opened this issue Nov 20, 2024 · 0 comments

Comments

@mythi
Copy link

mythi commented Nov 20, 2024

Additional Information

cargo audit reports RUSTSEC warnings for dependencies used by nydus. This issue is to get the two dependencies updated and a new release in crates.io.

Version of nydus being used (nydusd --version)

$ grep ^nydus Cargo.toml 
nydus-api = { version = "0.3.0", optional = true }
nydus-service = { version = "0.3.0", features = ["coco"], optional = true }
nydus = ["lazy_static", "nydus-api", "nydus-service"]
Crate:     vm-memory
Version:   0.10.0
Warning:   unsound
Title:     Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses
Date:      2023-09-01
ID:        RUSTSEC-2023-0056
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0056
Severity:  2.5 (low)
Dependency tree:
vm-memory 0.10.0
├── nydus-storage 0.6.4
│   ├── nydus-service 0.3.0
│   │   └── image-rs 0.1.0
│   │       └── confidential-data-hub 0.1.0
│   └── nydus-rafs 0.3.2
│       └── nydus-service 0.3.0
├── nydus-rafs 0.3.2
└── fuse-backend-rs 0.10.5
    ├── nydus-storage 0.6.4
    ├── nydus-service 0.3.0
    └── nydus-rafs 0.3.2

Crate:     vmm-sys-util
Version:   0.11.2
Warning:   unsound
Title:     `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access
Date:      2024-01-02
ID:        RUSTSEC-2024-0002
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0002
Severity:  5.7 (medium)
Dependency tree:
vmm-sys-util 0.11.2
└── fuse-backend-rs 0.10.5
    ├── nydus-storage 0.6.4
    │   ├── nydus-service 0.3.0
    │   │   └── image-rs 0.1.0
    │   │       └── confidential-data-hub 0.1.0
    │   └── nydus-rafs 0.3.2
    │       └── nydus-service 0.3.0
    ├── nydus-service 0.3.0
    └── nydus-rafs 0.3.2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant