Vulnerability in enum-map package: enum_map macro can cause UB when `Enum` trait is incorrectly implemented

Background

The enum-map package is a crate available on crates.io that provides a data structure called EnumMap. EnumMap is a map-like data structure that is optimized for enums as keys. It allows efficient storage and retrieval of values associated with enum variants. The package is commonly used in Rust projects that make use of enums and require a mapping between enum variants and values.

The vulnerability in the enum-map package arises from an incorrect implementation of the Enum trait, which is used by the enum_map! macro. This macro is responsible for creating an EnumMap instance based on the provided enum and associated values. Affected versions of the crate did not properly validate the length of the enum, leading to potential uninitialized types and the possibility of arbitrary code execution.

Vulnerability Detail

The vulnerability in the enum-map package allows an attacker to execute arbitrary code by exploiting an incorrect implementation of the Enum trait. When the LENGTH property in the Enum trait does not match the array length in the EnumArray trait, the enum map can be initialized with uninitialized types. This can be triggered when a manual implementation of the Enum trait is used, rather than relying on the #[derive(Enum)] macro. The uninitialized types can then be manipulated by an attacker to execute arbitrary code, potentially leading to a compromise of the system.

To illustrate this vulnerability, consider the following example code:

enum E {
    A,
    B,
    C,
}

impl Enum for E {
    const LENGTH: usize = 2;

    fn from_usize(value: usize) -> E {
        match value {
            0 => E::A,
            1 => E::B,
            2 => E::C,
            _ => unimplemented!(),
        }
    }

    fn into_usize(self) -> usize {
        self as usize
    }
}

impl<V> EnumArray<V> for E {
    type Array = [V; 3];
}

let _map: EnumMap<E, String> = enum_map! { _ => "Hello, world!".into() };

In this code, the Enum trait is manually implemented for the E enum, but the LENGTH property is set to 2, while the associated array length in the EnumArray trait is 3. This mismatch can result in uninitialized types and potential code execution.

Workaround

If updating the enum-map package is not immediately feasible, a possible workaround is to avoid using manual implementations of the Enum trait and instead rely on the #[derive(Enum)] macro. This macro ensures that the LENGTH property is correctly set based on the number of enum variants. By using the macro, the vulnerability can be mitigated. Here is an example of using the #[derive(Enum)] macro:

#[derive(Enum)]
enum E {
    A,
    B,
    C,
}

impl<V> EnumArray<V> for E {
    type Array = [V; 3];
}

let _map: EnumMap<E, String> = enum_map! { _ => "Hello, world!".into() };

Conclusion

The enum-map package is vulnerable to a code execution vulnerability due to an incorrect implementation of the Enum trait. This vulnerability can be mitigated by updating to version 2.0.2 or later of the package. Alternatively, using the #[derive(Enum)] macro instead of manual implementations of the Enum trait can also mitigate the vulnerability. It is recommended to update the package or apply the workaround to ensure the security of the system.

For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for enum-map →

FAQ