1 line
2.6 KiB
JSON
1 line
2.6 KiB
JSON
{"schema_version":"1.7.5","id":"RUSTSEC-2026-0143","published":"2026-05-14T12:00:00Z","modified":"2026-05-14T21:30:09.004866Z","summary":"Double-free in `vmem` storage reachable from safe Rust","details":"When the `vmem` feature is enabled, `VmemStorage<T>::new(Box<[UnsafeSyncCell<T>]>)` (and every public constructor that funnels through it — `ConcurrentHeapRB::default(cap)`, `ConcurrentHeapRB::from(Vec<T>)`, `From<Box<[T]>>`, etc.) bit-copies the input buffer into a freshly `mmap`'d region with `ptr::copy_nonoverlapping`, then lets the source `Box<[UnsafeSyncCell<T>]>` drop normally.\n\nBecause `UnsafeSyncCell<T>` has a `Drop` impl that runs `assume_init_drop` on its inner `MaybeUninit<T>`, the source-side `T` values are dropped at the end of `new`, while bitwise duplicates (carrying the same heap pointers for `String`, `Box`, `Vec`, `Arc`, …) remain inside the mmap region. When the ring buffer is later destructed, the destructor's `drop_in_place` over the slice runs `UnsafeSyncCell::drop` a second time on every cell — a deterministic double-free of every heap-owning element. Reachable from 100% safe Rust.\n\n## Trigger\n\n```rust\nlet v: Vec<Vec<u32>> = (0..1024).map(|i| vec![i, i+1, i+2]).collect();\nlet rb: oneringbuf::SharedVmemRB<Vec<u32>> = oneringbuf::SharedVmemRB::from(v);\ndrop(rb);\n// glibc: free(): double free detected in tcache 2 -> abort\n// ASan: AddressSanitizer: attempting double-free\n```\n\nAny `T` with a non-trivial `Drop` reproduces deterministically.\n\n## Fix\n\nFixed in `0.7.1` via upstream PR [skilvingr/rust-oneringbuf#3](https://github.com/skilvingr/rust-oneringbuf/pull/3), which deallocates the source `Box<[UnsafeSyncCell<T>]>` without running per-element `Drop` after the bytes have been copied into the mmap region. Vulnerable versions (`< 0.7.1`) have been yanked from crates.io.","affected":[{"package":{"name":"oneringbuf","ecosystem":"crates.io","purl":"pkg:cargo/oneringbuf"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.7.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["oneringbuf::VmemStorage::new"],"os":[]}},"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0143.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/oneringbuf"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0143.html"},{"type":"WEB","url":"https://github.com/skilvingr/rust-oneringbuf/pull/3"}],"database_specific":{"license":"CC0-1.0"}} |