MEDIUM

GHSA-mc9m-6fm9-pghc

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

Quick fix

GHSA-mc9m-6fm9-pghc — zoo-kcl: upgrade to the fixed version with the command below.

pip install --upgrade 'zoo-kcl>=0.3.153'

Details

A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment>>.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / zoo-kcl

Introduced in: 0 Fixed in: 0.3.153

Fix pip install --upgrade 'zoo-kcl>=0.3.153'

crates.io / kcl-lib

Introduced in: 0 Fixed in: 0.2.153

Upgrade kcl-lib to 0.2.153 or newer (ecosystem crates.io).

References

https://github.com/KittyCAD/modeling-app/security/advisories/GHSA-mc9m-6fm9-pghc [WEB]
https://github.com/KittyCAD/modeling-app [PACKAGE]