three more advisories

[hannesm]

No description provided.

[kit-ty-kate]

was this really worth a formal security advisory? To exploit this you'd have to use marshal (unsafe) and have access to marshalled data (if that's the case you've already been pwnd by something else beforehand).

[hannesm]

Indeed, similar to OSEC-2026-01, an application using Marshal on untrusted data is vulnerable.

When we discussed OSEC-2026-01, our approach for Marshal is that it should be memory-safe. The issue discovered here is an integer overflow leading to a out-of-heap read. So, we thought better to issue an advisory so that people are getting aware of this issue and update their systems.

Indeed, the question is what is the security boundary / threat model. And as explained above, for Marshal we have had a discussion. If you Marshal untrusted data, you may end up with type unsafe data, but you should keep memory safety.

[kit-ty-kate]

So does this mean that every memory safety issue is automatically a security issue regardless of exploitatability? If so that changes my mental model of what a security issue is

[hannesm]

I'm not sure what you mean with "regardless of exploitability"?

From the advisory:

let () =
  let buf = Bytes.create 40 in
  Bytes.set buf 0 (Char.chr 0x84); Bytes.set buf 1 (Char.chr 0x95);
  Bytes.set buf 2 (Char.chr 0xa6); Bytes.set buf 3 (Char.chr 0xbf);
  for i = 4 to 7 do Bytes.set buf i '\000' done;
  for i = 8 to 15 do Bytes.set buf i '\xff' done;
  Bytes.set buf 15 (Char.chr 0xf0);          (* data_len = 2^64 - 16 *)
  for i = 16 to 31 do Bytes.set buf i '\000' done;  (* num_objects = whsize = 0 *)
  Bytes.set buf 32 (Char.chr 0x3f);          (* small string, len 31 *)
  for i = 33 to 39 do Bytes.set buf i 'A' done;     (* only 7 real bytes follow *)
  let s : string = Marshal.from_bytes buf 0 in
  Printf.printf "len=%d content=%S\n" (String.length s) s

So, when your application accepts any untrusted input and calls Marshal.from_bytes on it, there is a heap disclosure, or a crash.

What are your semantics of "exploitable"? Remote code execution only?

[kit-ty-kate]

What are your semantics of "exploitable"? Remote code execution only?

no, i meant more like "exploitable (as long as the user of the feature doesn't do anything stupid)"

So, when your application accepts any untrusted input and calls Marshal.from_bytes on it

To me this precisely falls into the "as long as the user of the feature doesn't do anything stupid" asterisk.
To me this feels a bit like if someone said "your software has a bug. You see, i gave root access to my machine to some random guy and now i have malware, but it's your fault!"

If the feature is misused in that way, then it should be a security advisory on the user's code, rather than in the compiler, in my opinion.

[hannesm]

I agree that is a tricky distinction, and would appreciate if we'd only have to handle security advisories for applications. Now, since in ocaml/opam there are lots of libraries, we have to deal with security issues in there.

"As long as the user of the feature doesn't do anything stupid" - that's a great definition of exploitable, but unfortunately the "anything stupid" is a very subjective wording - and there may be some code that falls under it, while some other code doesn't -- depending on the person evaluating.

The security team takes a decision on when to issue advisories. An advisory is always there to help users and developers to detect potential issues and improve their code. It is of course a fact that in the OCaml/opam ecosystem a lot of libraries are developed and released, and just by using such a library, you won't necessarily have an exploit in your application.

Take a look at OSEC-2026-16, there are millions of usages of cohttp which won't be affected. There are others which are affected -- depending on whether you use the vulnerable function or not. Going from a security advisory for an OCaml library to evaluation whether your application is vulnerable is manual work (let me know if there's a way to do so automatically). The easy path is to update the dependency if it has a known vulnerability.

With respect to Marshal, until 2022 the widely used "unison" file synchronization tool used Marshal over the network. So, there may be other applications out there using that. I'm not aware of such an application (that listens on the network (or locally) for marshalled data).

I hope this makes sense, please let us know if you have further questions or remarks.