CRITICAL9.8

GHSA-3qm2-rfqw-fmrw

move_elements can double-free objects on panic

Details

Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding.

The flaw was fixed in commit `891561bea` by removing the unsafe block and using a plain iterator.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/scratchpad

Introduced in: 0Fixed in: 1.3.1

Upgrade scratchpad to 1.3.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2021-28031[ADVISORY]
https://github.com/okready/scratchpad/issues/1[WEB]
https://github.com/okready/scratchpad/commit/891561bea[WEB]
https://github.com/okready/scratchpad[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0030.html[WEB]