MEDIUM

GHSA-p6gj-gpc8-f8xw

Aliased mutable references from `tls_rand` & `TlsWyRand`

Details

`TlsWyRand`'s implementation of `Deref` unconditionally dereferences a raw pointer, and returns multiple mutable references to the same object, which is undefined behavior.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/nanorand

Introduced in: 0.5.0Fixed in: 0.6.1

Upgrade nanorand to 0.6.1 or newer (ecosystem crates.io).

References

https://github.com/Absolucy/nanorand-rs/issues/28[WEB]
https://github.com/Absolucy/nanorand-rs[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0114.html[WEB]