CVE-2023-53161

Vulnerability

Description

The Rust buffered-reader crate, versions prior to 1.1.5 (specifically including releases before 1.0.2 and between 1.1.0 and 1.1.4), contains a memory safety bug. When processing attacker-controlled input, the crate attempts to read from an array index that is outside the valid bounds. Rust's built-in bounds checking detects this violation, causing the application to panic rather than allowing arbitrary memory access [1][2].

Exploitation

An attacker can exploit this vulnerability by supplying crafted input to any application or library that uses the vulnerable buffered-reader crate for parsing. No authentication or special privileges are required; the attacker only needs a way to deliver the malicious data to the parser. This could be over the network (e.g., via a file upload, message injection, or data stream) or locally, depending on how the library is integrated [2][4].

Impact

Successful exploitation leads to a denial of service (DoS): the application crashes due to an unhandled panic. The advisory from Sequoia-PGP explicitly notes that memory corruption is not possible because Rust's safety guarantees prevent out-of-bounds write access, so the primary impact is availability [2][4].

Mitigation

The issue is fixed in buffered-reader versions 1.0.2, 1.1.5, and all 1.2.x releases [2]. Users should update to at least one of these patched versions. No workarounds are provided. The vulnerability is tracked under CVE-2023-53161 and GHSA-29mf-62xx-28jq [2][3].