Executive Summary

This security assessment was conducted using Kolega.dev's automated security remediation platform, which combines traditional security scanning (SAST, SCA, secrets detection) with proprietary AI-powered deep code analysis. Our two-tier detection approach identified vulnerabilities that standard tools miss, including complex logic flaws and cross-service injection vectors.

Our analysis of the Qdrant repository identified 1 vulnerabilities through Kolega.dev Deep Code Scan (Tier 2) that warrant attention.

Vulnerability Overview

Responsible Disclosure Timeline

Kolega.dev follows responsible disclosure practices. We coordinated privately through Qdrant's official security reporting channel.

Vulnerabilities Detail

V1: Unsafe memory access without complete bounds validation in CSR loader

CWE: CWE-123 (Write-what-where Condition), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Location: lib/sparse/src/index/loaders.rs:79-100

Description
The Csr::vec() method uses unsafe code with get_unchecked() to access memory-mapped data without proper bounds checking. While the indptr validation checks monotonicity, it does not validate against actual buffer sizes, allowing out-of-bounds memory access.

Evidence
The code validates that indptr[i] <= indptr[i+1] in from_mmap (line 63), but never validates that these offsets actually point to valid ranges within the mmap buffer. The multiplication size_of::<u32>() * start can cause integer overflow without checks, and the resulting range can exceed buffer bounds. The use of get_unchecked() on line 81-82 and 89, 96 bypasses bounds validation entirely.

Impact
An attacker can craft a malicious CSR file with invalid indptr values that cause out-of-bounds memory reads. This could lead to information disclosure (reading adjacent memory) or denial of service (crash).

Remediation

1. Validate that calculated offsets don't overflow: use checked_mul() and validate against mmap length.

2. Use get() instead of get_unchecked().

3. Validate that start and end indices are within valid ranges relative to nnz before calculating byte offsets.