Rustix: xattr functions mark unwritten bytes as initialized when given a zero-length buffer
Affects rustixSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.1.6
Data as of 11 Nov 2026, 10:32 UTC
What to do
Upgrade rustix to 1.1.6.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iorustixpkg:cargo/rustixOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should upgrade rustix to version 1.1.6 or later, where the issue is fixed. The fixed version returns empty results for zero-length buffers and provides new query functions to safely obtain attribute sizes. No other mitigation is required as the patch fully addresses the problem.
Description
The rustix crate's extended-attribute functions in versions >=1.0.0 and <1.1.6 incorrectly mark unwritten bytes as initialized when given a zero-length buffer, leading to undefined behavior accessible from safe Rust code. This occurs because the functions mark as initialized the number of bytes reported by the system call, even though no bytes are written when the buffer length is zero. The issue is fixed in version 1.1.6 by returning empty results for zero-length buffers and introducing new query functions to safely obtain size information.