MEDIUM

GHSA-j8cj-hw74-64jv

Hive has Double-free and Use After Free Vulnerabilities

Details

`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free.

Additionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with `as_handle` easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/hivex

Introduced in: 0.2.0Fixed in: 0.2.1

Upgrade hivex to 0.2.1 or newer (ecosystem crates.io).

References

https://codeberg.org/1millibyte/toolsnt/commit/f4c7a0d1fc4a08ce40bb76e447a69a6f383a916e[WEB]
https://codeberg.org/1millibyte/toolsnt/issues/18[WEB]
https://docs.rs/crate/hivex[WEB]
https://docs.rs/crate/hivex/0.2.1/source[WEB]
https://rustsec.org/advisories/RUSTSEC-2026-0029.html[WEB]