{
  "schema_version": "1.4.0",
  "id": "GHSA-qm2p-4w45-v2vr",
  "modified": "2025-02-10T18:07:30Z",
  "published": "2025-02-10T18:07:30Z",
  "aliases": [],
  "summary": "grcov has an out of bounds write triggered by crafted coverage data",
  "details": "Function `grcov::covdir::get_coverage` uses the `unsafe` function `get_unchecked_mut` without validating that the index is in bounds.\n\nThis results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.",
  "severity": [],
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "grcov"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.20"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mozilla/grcov/commit/c8219563bc91615dd4a27884a5c63f09db8d03bb"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1917475"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mozilla/grcov"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0005.html"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-10T18:07:30Z",
    "nvd_published_at": null
  }
}