CVE-2023-50711: Medium Out of Bounds Access in vmm-sys-util

CVE-2023-50711 is a medium severity out of bounds memory access flaw in vmm-sys-util, a Rust crate used by rust-vmm projects. Versions from 0.5.0 up to but not including 0.12.0 are affected. NVD scores it 5.7. Upgrade to vmm-sys-util 0.12.0 or later.

What's affected

The advisory and the record agree on the range: vmm-sys-util starting at version 0.5.0 and prior to 0.12.0. Version 0.12.0 is the fix. The record was published on 2024-01-02.

Both sources rate it moderate. NVD scores it 5.7 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L. The attack vector is local and the scope is changed, which is the usual shape for a flaw in a library used by virtual machine monitors.

The cause sits in the FamStructWrapper::deserialize implementation. Deserialization does not check that the length stored in the header matches the length of the flexible array. A mismatch can allow out of bounds access through methods that look safe to Rust code. The fix adds a check that aborts deserialization when the lengths differ, and restricts header length changes to unsafe code. The advisory lists no workaround.

How to check if you're exposed

Find out whether the crate is in your dependency tree and which version resolves:

cargo tree -i vmm-sys-util

Anything from 0.5.0 up to 0.11.x is affected. In a workspace, run it from the root so you see every consumer. Then look at your Cargo.lock directly if you ship binaries, since the lock file records what is actually built.

Next, ask whether the vulnerable function is called. The flaw is in the deserialize method for the flexible array wrapper. A project that includes the crate but never deserializes those structures has the code present but not reachable, which lowers urgency. Reachability analysis is built for exactly that question.

What to do now

1. Run cargo tree and list every project that includes vmm-sys-util below 0.12.0.
2. Update the crate to 0.12.0 or later, which may require updating the rust-vmm crates that depend on it.
3. Run cargo update and review Cargo.lock to confirm the new version resolves.
4. Rebuild and redeploy binaries, since Rust links dependencies statically.
5. Check any operating system packages for rust-vmm based tools and apply vendor updates.

Why it matters

The weakness is an out of bounds write, CWE-787. Rust's safety guarantees depend on its safe code holding invariants. Here a deserialized header could claim a length that does not match the real array, and safe looking methods then trusted the wrong number.

This is a good example of why a memory safe language does not remove the need to patch. Unsafe code and trusted data formats still sit underneath, and a library bug there reaches every program that uses it.

The record shows no CISA Known Exploited Vulnerabilities listing, and the advisory does not report exploitation in the wild.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• rust-vmm security advisory GHSA-875g-mfp6-g7f9

Last reviewed: 19 October 2026.