CVE-2018-20998: Memory Corruption in arrayfire
Summary
CVE-2018-20998: Enum repr causing potential memory corruption. Affects arrayfire versions >= 3.5.1-0, < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Arrayfire is an open-source library that provides a high-level interface for parallel computing with GPUs. It is commonly used for numerical computations and data processing. The library allows developers to leverage the power of GPUs for faster and more efficient computations. However, a vulnerability has been discovered in versions of arrayfire prior to 3.6.0, which could lead to memory corruption.
Vulnerability Detail
The vulnerability in arrayfire is related to the attribute repr() added to enums to be compatible with C-FFI. This addition caused memory corruption on the MSVC toolchain. The issue only started to appear since Rust version 1.28. The memory corruption can have severe consequences, including potential crashes, data corruption, and even remote code execution. It is important to update to version 3.6.0 or later to mitigate this vulnerability.
How To Fix
Minimum fixed version
3.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to version 3.6.0 or later to fix the issue.
Conclusion
The vulnerability in arrayfire can lead to memory corruption and has the potential for severe consequences. It is crucial to update to version 3.6.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for arrayfire →
FAQ
Arrayfire is an open-source library that provides a high-level interface for parallel computing with GPUs. It is commonly used for numerical computations and data processing.
The vulnerability can lead to memory corruption, which can result in crashes, data corruption, and potentially remote code execution.
To fix the vulnerability, update the arrayfire crate to version 3.6.0 or later.
No, there is no known workaround. Updating to version 3.6.0 or later is necessary to address the vulnerability.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-69fv-gw6g-8ccg/GHSA-69fv-gw6g-8ccg.json
References
Related vulnerabilities
Recent vulnerabilities recorded for arrayfire.
