`blake3` versions 0.3.7 - 1.1.0 had a potential memory corruption bug on Windows
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 1.2k
- Forks
- 544
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 45
Description
This was fixed in v1.2.0 (Nov 5, 2021). See https://github.com/BLAKE3-team/BLAKE3/issues/206 and https://github.com/BLAKE3-team/BLAKE3/releases/tag/1.2.0.
Triggering this bug in the affected versions requires a Windows environment that either 1) lacks SSE4.1 support (i.e. an x86 CPU older than 2007), or 2) sets default_features = false. Some callers (e.g. multihash) do set default_features = false in their dependencies, so option 2 is probably more likely than option 1. When the bug is triggered, it corrupts an SSE register, and the effect of that depends on the caller. I'm not aware of any cases in the wild where it had any observable effect. When I've been able to see an effect in testing, it's a corrupt/incorrect hash value, which is arguably a security issue even if there's no path to general memory corruption.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files or tests are named. Start by checking how this advisory database records Rust crate vulnerabilities, then review BLAKE3 issue 206 and release 1.2.0. Done means documenting the affected blake3 versions, Windows trigger conditions, and the fixed version in the repository's established advisory format.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100