~ / search / GHSA-v362-2895-h9r2

GHSA-v362-2895-h9r2

Use After Free in lru

Source: GitHub Advisory Database (reviewed) High CVE-2021-45720

Packages

EcosystemPackageAffectedFixed in
crates.io lru < 0.7.1 0.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.

References

External links from the advisory. They lead to third-party sites.