CRITICAL 9.8

GHSA-c3cw-c387-pj65

Double free in crossbeam

Details

Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees.

The flaw was corrected by wrapping elements inside queues in a ManuallyDrop.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io / crossbeam

Introduced in: 0.4.0 Fixed in: 0.4.1

Upgrade crossbeam to 0.4.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2018-20996 [ADVISORY]
https://github.com/crossbeam-rs/crossbeam-epoch/issues/82 [WEB]
https://github.com/crossbeam-rs/crossbeam-epoch [PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2018-0009.html [WEB]