RUSTSEC-2026-0486: xattr functions mark unwritten bytes as initialized when given a zero-length buffer

Open
  • Is something wrong?
#36 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
55/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
security

Research direction

The issue identifies rustix 1.1.4 and the affected extended-attribute functions, but does not name files or tests in this repository. Start by checking the dependency declaration and lockfile for the rustix version, then review how the gateway uses the affected functions and the advisory page. Done means confirming whether this project is affected and, if so, updating to a fixed version with relevant coverage.

Written by the indexing model from the issue text.

Description

xattr functions mark unwritten bytes as initialized when given a zero-length buffer

Details
Status unsound
Package rustix
Version 1.1.4
URL https://github.com/bytecodealliance/rustix/commit/8e6aaa6713d2bb64b1fdd8c472e3a32a10a76d70
Date 2026-10-27

The extended-attribute functions in rustix::fs (getxattr, lgetxattr, fgetxattr, listxattr, llistxattr and flistxattr) write into a Buffer and then mark as many bytes initialized as the system call reported. When the buffer has zero length, the operating system treats the call as a size query: it writes nothing and returns the size of the attribute value or of the name list. rustix still marked that many bytes as initialized.

Passing a Vec whose length equals its capacity through spare_capacity gives such a zero-length buffer, and rustix then set the vector's length past its capacity over memory that was never written. This is undefined behavior reachable from safe code. With an empty &mut [MaybeUninit<u8>] the call panics instead.

From 1.1.6 these functions return an empty result for a zero-length buffer, and new getxattr_query, lgetxattr_query, fgetxattr_query, listxattr_query, llistxattr_query and flistxattr_query functions return the size. The 0.38 series did not have the Buffer API and is not affected.

See advisory page for additional details.

Dominant language
Rust
Stars
0
Forks
2
Avg merge
14d 2h
Merged PRs (30d)
1

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stackabletech/postgresql-trino-gateway

All issues in stackabletech/postgresql-trino-gateway

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.