rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2025-12-27 01:54:07 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
8c05fea5fa6e1776c015b855eebaa344d00e28a7
advisory-db/crates/crossbeam/RUSTSEC-2018-0009.md
Alexis Mousset 8c05fea5fa Add cvss information from nvd (#1085)
2021-10-19 16:14:35 -06:00

695 B
Raw Blame History 

[advisory]
id = "RUSTSEC-2018-0009"
package = "crossbeam"
aliases = ["CVE-2018-20996"]
cvss = "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
date = "2018-12-09"
keywords = ["concurrency", "memory-management", "memory-corruption"]
url = "https://github.com/crossbeam-rs/crossbeam-epoch/issues/82"

[versions]
patched = [">= 0.4.1"]
unaffected = ["< 0.4.0"]

MsQueue and SegQueue suffer from double-free

Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees.

The flaw was corrected by wrapping elements inside queues in a ManuallyDrop.

Thanks to @c0gent for reporting the issue.