GHSA-c3cw-c387-pj65

Double free in crossbeam

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-20996

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	crossbeam	>= 0.4.0, < 0.4.1	0.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees. The flaw was corrected by wrapping elements inside queues in a ManuallyDrop.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20996 advisory
https://github.com/crossbeam-rs/crossbeam-epoch/issues/82 web
https://github.com/crossbeam-rs/crossbeam-epoch package
https://rustsec.org/advisories/RUSTSEC-2018-0009.html web