Affected versions of sys-info use a static, global, list to store temporary disk information while running. The function that cleans up this list, DFCleanup, assumes a single threaded environment and will try to free the same memory twice in a multithreaded environment. This results in consistent double-frees and segfaults when calling sysinfo::diskinfo from multiple threads at once. The issue was fixed by moving the global variable into a local scope.
{ "nvd_published_at": "2021-08-08T06:15:00Z", "cwe_ids": [ "CWE-415" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2021-08-18T20:16:40Z" }