Eclipse Iceoryx
Monthly
Eclipse iceoryx2 versions after v0.8.0 up to v0.9.x contain a Rust soundness defect in which StaticString exposes its contents as mutable bytes via safe APIs, and the associated String::as_str() conversion does not validate UTF-8, allowing safe Rust code to construct an invalid &str and trigger undefined behavior. Exploitation requires a local authenticated attacker with low privileges and high attack complexity, and it additionally depends on an application coded in the vulnerable pattern; impact is limited to minor integrity and availability loss with no confidentiality impact, and the defect is not remotely exploitable against a default configuration. No public exploit code or active exploitation has been identified, and the vendor has released a patched version v0.10.0.
Eclipse iceoryx2 versions after v0.8.0 up to v0.9.x contain a Rust soundness defect in which StaticString exposes its contents as mutable bytes via safe APIs, and the associated String::as_str() conversion does not validate UTF-8, allowing safe Rust code to construct an invalid &str and trigger undefined behavior. Exploitation requires a local authenticated attacker with low privileges and high attack complexity, and it additionally depends on an application coded in the vulnerable pattern; impact is limited to minor integrity and availability loss with no confidentiality impact, and the defect is not remotely exploitable against a default configuration. No public exploit code or active exploitation has been identified, and the vendor has released a patched version v0.10.0.