GHSA-vgmh-mqm4-8j88

Source

https://github.com/advisories/GHSA-vgmh-mqm4-8j88

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vgmh-mqm4-8j88/GHSA-vgmh-mqm4-8j88.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vgmh-mqm4-8j88

Published

2025-03-24T16:06:28Z

Modified

2025-03-24T16:06:28Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

Details

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were - pared::prc::Prc::from_rc - pared::prc::Prc::project - pared::prc::Prc::try_from_rc - pared::sync::Parc::from_arc - pared::sync::Parc::project - pared::sync::Parc::try_from_arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-416"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-24T16:06:28Z"
}

References

Affected packages

crates.io / pared

Package

Name: pared; View open source insights on deps.dev
Purl: pkg:cargo/pared

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.0