UNKNOWN READ Vulnerability in spirv-tools
Summary
OSV-2024-592: UNKNOWN READ in spvtools::disassemble::InstructionDisassembler::EmitInstruction. Affects spirv-tools versions >= c3178da8eac9bc7d1788e95f8d555918ba483c23, < 64d37e2811a794f614bc569338afa47dbdfefa0e. Fixed in 64d37e2811a794f614bc569338afa47dbdfefa0e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
spirv-tools is an open-source library that provides a set of tools and utilities for working with SPIR-V, a binary intermediate language for representing shaders and compute kernels. It is commonly used in graphics and compute applications. The library allows for disassembling SPIR-V binaries into human-readable text format, among other functionalities.
Vulnerability Detail
The vulnerability identified as OSV-2024-592 in spirv-tools is an UNKNOWN READ vulnerability in the InstructionDisassembler component of the library. This vulnerability can be triggered when processing certain SPIR-V instructions, leading to an unknown read operation. The exact cause and impact of this vulnerability are currently unknown. However, it has been reported as a crash type issue in the spvtools::disassemble::InstructionDisassembler::EmitInstruction function, which is called during the disassembly process. Further investigation is required to determine the potential ramifications and exploitability of this vulnerability.
How To Fix
Minimum fixed version
64d37e2811a794f614bc569338afa47dbdfefa0e
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. It is advised to monitor the official repository and relevant security advisories for updates and patches from the spirv-tools developers.
Conclusion
The UNKNOWN READ vulnerability in the InstructionDisassembler component of spirv-tools poses a potential risk to applications utilizing the library for SPIR-V disassembly. The exact impact and exploitability of this vulnerability are yet to be determined. Developers are advised to monitor official updates and patches from the spirv-tools team and consider implementing fixes once they become available.
See every vulnerability recorded for spirv-tools →
FAQ
spirv-tools is an open-source library for working with SPIR-V binaries, providing various tools and utilities.
SPIR-V is a binary intermediate language used for representing shaders and compute kernels in graphics and compute applications.
An UNKNOWN READ vulnerability refers to a situation where an unknown memory read operation occurs, potentially leading to crashes or other undefined behavior.
The exact exploitability of this vulnerability is currently unknown. Further investigation is required to assess the potential impact and possible attack vectors.
As of now, there is no known fix for this vulnerability. It is recommended to stay updated with official announcements and security advisories from the spirv-tools developers.
References
Related vulnerabilities
Recent vulnerabilities recorded for spirv-tools.
