Skip to content

Add advisory for use after free in pared <=0.3.0#2253

Merged
djc merged 1 commit intorustsec:mainfrom
radekvit:pared/use-after-free
Mar 22, 2025
Merged

Add advisory for use after free in pared <=0.3.0#2253
djc merged 1 commit intorustsec:mainfrom
radekvit:pared/use-after-free

Conversation

@radekvit
Copy link
Contributor

Use after free in Parc and Prc due to missing lifetime constraints

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion
functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create
projections of these reference counted pointers. Unlike the original reference counted pointers,
these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at
a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were

  • pared::prc::Prc::from_rc
  • pared::prc::Prc::project
  • pared::prc::Prc::try_from_rc
  • pared::sync::Parc::from_arc
  • pared::sync::Parc::project
  • pared::sync::Parc::try_from_arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e
by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

@djc
Copy link
Member

djc commented Mar 22, 2025

LGTM, thanks!

@djc djc merged commit 38d6997 into rustsec:main Mar 22, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants