Security Advisory for <1.0 Lexical-Core (Patched in 1.0)

[Alexhuszagh]

There was a security advisory for lexical (RUSTSEC-2023-0055), which uses lexical-core for the implementation. There was a few discovered instances of undefined behavior with a comprehensive code analysis due to further misuse of MaybeUninit.

This affected all versions before lexical 7.0 and lexical-core before 1.0. All of the issues initially discovered were:

• [BUG] Safety comments for MaybeUninit::assume_init calls are wrong, calls are UB Alexhuszagh/rust-lexical#95
• [BUG] Unsoundness: try_parse_{4,8}digits appear to advance iterators out of bounds Alexhuszagh/rust-lexical#101
• [BUG] Unsoundness in Bytes::read() Alexhuszagh/rust-lexical#102
• [BUG] BytesIter should be an unsafe trait or private Alexhuszagh/rust-lexical#104

The additional discovered unsoundness includes:

• [BUG] Radix Integer Formatter Incorrectly Uses Uninitialized Memory Alexhuszagh/rust-lexical#126

There were a few more patches that were implemented as part of that fix (also all related to misuse of MaybeUninit. All older versions of lexical-core should therefore have a security advisory associated with them.

Here's additional instances of unsoundness:

• https://github.com/Alexhuszagh/rust-lexical/blob/933e2cca11736fc230ba7c3cbbad58bb58a89d13/lexical-write-float/src/compact.rs#L67-L69

[Alexhuszagh]

Closed in PR #2083