PT-2025-45714

Published

2025-10-21

·

Updated

2025-10-21

Description by

CVSS 4.0
2.0
Low
MetricsAV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
The safe function create ring buffer allocates a buffer using Vec::with capacity followed by set len, creating a Box<[T]> containing uninitialized memory.
This leads to undefined behavior when functions like write slices create typed slices (e.g., &mut [bool]) over the uninitialized memory, violating Rust's validity invariants. The issue has been confirmed using Miri.
Fixed in version 0.2.2 by using resize with to properly initialize the buffer with T::default(), adding a T: Default bound to ensure sound initialization.
Exploitability
Fix
Impacts
Vendors
Affected products
Related identifiers
GHSA-FP5X-7M4Q-449F
Found an issue in the description? Have something to add? Feel free to write us 👾