OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-29 15:56:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

Initial advisory for owning_ref unsoundness (#1188)

Browse Source 
* Initial advisory for owning_ref unsoundness

* move owning_ref advisory to a subfolder where it belongs

* Add OwningRef::map is unsound to owning_ref

Co-authored-by: pinkforest <36498018+pinkforest@users.noreply.github.com>
This commit is contained in:
Sergey "Shnatsel" Davidoff
2022-08-02 21:41:46 +02:00
committed by GitHub
parent d8dd62801c
commit ff384c3d46
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
crates/owning_ref/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,20 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "owning_ref"
date = "2022-01-26"
url = "https://github.com/noamtashma/owning-ref-unsoundness"
references = ["https://github.com/Kimundi/owning-ref-rs/issues/49", "https://github.com/Kimundi/owning-ref-rs/issues/61", "https://github.com/Kimundi/owning-ref-rs/issues/71", "https://github.com/Kimundi/owning-ref-rs/issues/77"]
categories = ["memory-corruption"]
[versions]
patched = []
```
# Multiple soundness issues in `owning_ref`
- `OwningRef::map_with_owner` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/77) and may result in a use-after-free.
- `OwningRef::map` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/71) and may result in a use-after-free.
- `OwningRefMut::as_owner` and `OwningRefMut::as_owner_mut` are [unsound](https://github.com/Kimundi/owning-ref-rs/issues/61) and may result in a use-after-free.
- The crate [violates Rust's aliasing rules](https://github.com/Kimundi/owning-ref-rs/issues/49), which may cause miscompilations on recent compilers that emit the LLVM `noalias` attribute.
No patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.