Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gfx-rs/wgpu
trunk @ 3fb225a
11
Fixes
1
CVEs
CRITICAL
Peak severity
11.1%
Coverage
Highlights
Denial of Service: 6 prior fixes. Scrutinize any change in this area.
wgpu-core: most-fixed (8 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Out-of-bounds Read/Write: Incorrect clamping calculations in indirect draw validation can allow the offset to exceed the binding size, resulting in dangerous out-of-bounds memory accesses on the GPU. This compromises the isolation guarantees of WebGPU.
Use After Free: Improper lifetime and state tracking of query sets during active command submissions can lead to use-after-free vulnerabilities. QuerySets must be validated and have their destruction deferred until all referencing GPU command submissions complete.
Information Disclosure: Failure to track the initialization state of multi-aspect textures per aspect, or neglecting to zero-initialize unwritten query slots, allows WebGPU shaders to leak uninitialized GPU memory across context boundaries.