CVE-2020-15254RUSTSEC-2020-0052GHSA-M8H8-V6JH-C762GHSA-V5M7-53CV-F3HX
Undefined Behavior in bounded Crossbeam channel
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.4.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.
Timeline
- CVE published
- Record last updated
Affected versions
- crossbeam-rs crossbeam
fixed in 0.4.4
- crossbeam-channelcrates.io
From 0.4.3 · fixed in 0.4.4
- crossbeam-channelcrates.io
From 0.4.3 · fixed in 0.4.4