From fd45ce4eb50056cbea67a012313210415b62bea2 Mon Sep 17 00:00:00 2001 From: Stjepan Glavina Date: Sun, 9 Dec 2018 14:07:06 +0000 Subject: [PATCH 1/4] A bug in crossbeam v0.4.0 --- crates/crossbeam/RUSTSEC-0000-0000.toml | 56 +++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 crates/crossbeam/RUSTSEC-0000-0000.toml diff --git a/crates/crossbeam/RUSTSEC-0000-0000.toml b/crates/crossbeam/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..1f150f1 --- /dev/null +++ b/crates/crossbeam/RUSTSEC-0000-0000.toml @@ -0,0 +1,56 @@ +[advisory] +# Identifier for the advisory (mandatory). Will be assigned a "RUSTSEC-YYYY-NNNN" +# identifier e.g. RUSTSEC-2018-0001. Please use "RUSTSEC-0000-0000" in PRs. +id = "RUSTSEC-0000-0000" + +# Name of the affected crate (mandatory) +package = "crossbeam" + +# Disclosure date of the advisory as an RFC 3339 date (mandatory) +date = "2018-12-09" + +# Single-line description of a vulnerability (mandatory) +title = "MsQueue and SegQueue suffer from double-free" + +# Enter a short-form description of the vulnerability here (mandatory) +description = """ +Even if an element is popped from a queue, crossbeam would run its +destructor inside the epoch-based garbage collector. This is a source +of double frees. + +The flaw was corrected by wrapping elements inside queues in a +`ManuallyDrop`. + +Thanks to @c0gent for reporting the issue. +""" + +# Versions which include fixes for this vulnerability (mandatory) +patched_versions = [">= 0.4.1"] + +# Versions which were never vulnerable (optional) +#unaffected_versions = ["< 1.1.0"] + +# URL to a long-form description of this issue, e.g. a GitHub issue/PR, +# a change log entry, or a blogpost announcing the release (optional) +url = "https://github.com/crossbeam-rs/crossbeam-epoch/issues/82" + +# Keywords which describe this vulnerability, similar to Cargo (optional) +keywords = ["concurrency", "memory-management"] + +# Vulnerability aliases, e.g. CVE IDs (optional but recommended) +# Request a CVE for your RustSec vulns: https://iwantacve.org/ +#aliases = ["CVE-2018-XXXX"] + +# References to related vulnerabilities (optional) +# e.g. CVE for a C library wrapped by a -sys crate) +#references = ["CVE-2018-YYYY", "CVE-2018-ZZZZ"] + +# CPU architectures impacted by this vulnerability (optional) +# For a list of CPU architecture strings, see the "platforms" crate: +# +#affected_arch = ["x86", "x86_64"] + +# Operating systems impacted by this vulnerability (optional) +# For a list of OS strings, see the "platforms" crate: +# +#affected_os = ["windows"] From e717bd76c255c1e705cbb0fa3d167a3e93d1ae46 Mon Sep 17 00:00:00 2001 From: Stjepan Glavina Date: Sun, 9 Dec 2018 14:24:34 +0000 Subject: [PATCH 2/4] Mark < 0.4.0 as unaffected --- crates/crossbeam/RUSTSEC-0000-0000.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/crossbeam/RUSTSEC-0000-0000.toml b/crates/crossbeam/RUSTSEC-0000-0000.toml index 1f150f1..0360367 100644 --- a/crates/crossbeam/RUSTSEC-0000-0000.toml +++ b/crates/crossbeam/RUSTSEC-0000-0000.toml @@ -28,7 +28,7 @@ Thanks to @c0gent for reporting the issue. patched_versions = [">= 0.4.1"] # Versions which were never vulnerable (optional) -#unaffected_versions = ["< 1.1.0"] +unaffected_versions = ["< 0.4.0"] # URL to a long-form description of this issue, e.g. a GitHub issue/PR, # a change log entry, or a blogpost announcing the release (optional) From 968e1279f6f0c0d1234f30dc20d171ebd7ec7e80 Mon Sep 17 00:00:00 2001 From: Stjepan Glavina Date: Sun, 9 Dec 2018 16:46:28 +0000 Subject: [PATCH 3/4] Remove comments --- crates/crossbeam/RUSTSEC-0000-0000.toml | 37 ------------------------- 1 file changed, 37 deletions(-) diff --git a/crates/crossbeam/RUSTSEC-0000-0000.toml b/crates/crossbeam/RUSTSEC-0000-0000.toml index 0360367..bc58ce7 100644 --- a/crates/crossbeam/RUSTSEC-0000-0000.toml +++ b/crates/crossbeam/RUSTSEC-0000-0000.toml @@ -1,18 +1,8 @@ [advisory] -# Identifier for the advisory (mandatory). Will be assigned a "RUSTSEC-YYYY-NNNN" -# identifier e.g. RUSTSEC-2018-0001. Please use "RUSTSEC-0000-0000" in PRs. id = "RUSTSEC-0000-0000" - -# Name of the affected crate (mandatory) package = "crossbeam" - -# Disclosure date of the advisory as an RFC 3339 date (mandatory) date = "2018-12-09" - -# Single-line description of a vulnerability (mandatory) title = "MsQueue and SegQueue suffer from double-free" - -# Enter a short-form description of the vulnerability here (mandatory) description = """ Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source @@ -23,34 +13,7 @@ The flaw was corrected by wrapping elements inside queues in a Thanks to @c0gent for reporting the issue. """ - -# Versions which include fixes for this vulnerability (mandatory) patched_versions = [">= 0.4.1"] - -# Versions which were never vulnerable (optional) unaffected_versions = ["< 0.4.0"] - -# URL to a long-form description of this issue, e.g. a GitHub issue/PR, -# a change log entry, or a blogpost announcing the release (optional) url = "https://github.com/crossbeam-rs/crossbeam-epoch/issues/82" - -# Keywords which describe this vulnerability, similar to Cargo (optional) keywords = ["concurrency", "memory-management"] - -# Vulnerability aliases, e.g. CVE IDs (optional but recommended) -# Request a CVE for your RustSec vulns: https://iwantacve.org/ -#aliases = ["CVE-2018-XXXX"] - -# References to related vulnerabilities (optional) -# e.g. CVE for a C library wrapped by a -sys crate) -#references = ["CVE-2018-YYYY", "CVE-2018-ZZZZ"] - -# CPU architectures impacted by this vulnerability (optional) -# For a list of CPU architecture strings, see the "platforms" crate: -# -#affected_arch = ["x86", "x86_64"] - -# Operating systems impacted by this vulnerability (optional) -# For a list of OS strings, see the "platforms" crate: -# -#affected_os = ["windows"] From e769e16a6c0aedcdbdc5942050e8af589defc5c9 Mon Sep 17 00:00:00 2001 From: Stjepan Glavina Date: Sun, 9 Dec 2018 16:57:04 +0000 Subject: [PATCH 4/4] Add memory-corruption --- crates/crossbeam/RUSTSEC-0000-0000.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/crossbeam/RUSTSEC-0000-0000.toml b/crates/crossbeam/RUSTSEC-0000-0000.toml index bc58ce7..1d33df5 100644 --- a/crates/crossbeam/RUSTSEC-0000-0000.toml +++ b/crates/crossbeam/RUSTSEC-0000-0000.toml @@ -16,4 +16,4 @@ Thanks to @c0gent for reporting the issue. patched_versions = [">= 0.4.1"] unaffected_versions = ["< 0.4.0"] url = "https://github.com/crossbeam-rs/crossbeam-epoch/issues/82" -keywords = ["concurrency", "memory-management"] +keywords = ["concurrency", "memory-management", "memory-corruption"]