Memory Deallocation Vulnerability in hugepage-rs: Unsafe Functionality in Safe Code
Summary
RUSTSEC-2025-0170: hugepage_rs::dealloc may allow invalid memory deallocation from safe code. Affects hugepage-rs versions >= 0.0.0-0, < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hugepage-rs package is a Rust library designed for managing memory allocation using huge pages, which can enhance performance for certain applications by reducing page table overhead. It provides a safe interface for memory allocation and deallocation. However, a critical vulnerability was discovered in its deallocation function, which could lead to undefined behavior if misused.
Vulnerability Detail
The vulnerability arises from the hugepage_rs::dealloc function, which was publicly accessible and allowed safe Rust code to deallocate memory using an arbitrary raw pointer and layout. This function did not verify if the pointer was valid or if it matched the layout used during allocation. As a result, calling dealloc with an invalid pointer or incorrect layout could lead to memory corruption and undefined behavior, posing significant risks to application stability and security.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no direct workarounds for this vulnerability other than ensuring that you do not use the hugepage_rs::dealloc function until you have updated to the patched version. If you must use it, ensure that you only pass valid pointers and layouts, but this is inherently unsafe and not recommended.
Conclusion
The hugepage-rs package contains a significant vulnerability in its memory deallocation function, which can lead to undefined behavior when misused. It is crucial to update to version 0.1.1 or later to mitigate these risks. Users should be cautious and avoid using the affected function until they can ensure their code adheres to the necessary safety requirements.
See every vulnerability recorded for hugepage-rs →
FAQ
The vulnerability allows safe code to deallocate memory incorrectly, leading to potential memory corruption and undefined behavior.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability can lead to application crashes, data corruption, and security breaches due to undefined behavior.
No, the dealloc function should not be used in safe code until the package is updated to the patched version, as it does not enforce safety checks.
If you cannot update the package, avoid using the dealloc function and review your code for any unsafe memory operations.
