GHSA-7mcq-f592-pf7v RUSTSEC-2025-0044
Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-415 Double Free
- Fix
- None yet
- No fixed version published
Description
The crate slice-ring-buffer was developed as a fork of slice-deque to continue maintenance and provide security patches, since the latter has been officially unmaintained (RUSTSEC-2020-0158).
While slice-ring-buffer has addressed some previously reported memory safety issues inherited from its fork origin (RUSTSEC-2021-0047), it still retains multiple unresolved memory corruption vulnerabilities.
Specifically, we have discovered four new memory safety bugs, each resulting in double-free violations that can occur when only safe APIs are invoked. These vulnerabilities correspond to four distinct safe APIs in the crate, each exposing unsound and vulnerable behavior due to incorrect usage of unsafe code internally.
Unfortunately, the maintainer doesn't have much availability to resolve these issues so there's no concrete timeline for fixes. Community contributions towards fixing these vulnerabilities would be much appreciated.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| slice-deque | <= 0.3.0 |
No fix yet |
| slice-ring-buffer | <= 0.3.4 |
No fix yet |
| slice-ring-buffer | >= 0.0.0-0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
Weakness
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Implementation: Use a static analysis tool to find double free instances.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p9gf-gmfv-398m Double free in slice-deque | High | Also affects slice-deque |
| RUSTSEC-2020-0158 slice-deque is unmaintained | Not rated yet | Also affects slice-deque |
| GHSA-c3m3-c39q-pv23 Out of bounds write in slice-deque | Critical | Also affects slice-deque |
| GHSA-hr3c-6mmp-6m39 Memory corruption slice-deque | Critical | Also affects slice-deque |
| GO-2026-4981 Crash when handling long CNAME response in net | High | Same weakness, CWE-415 |
| GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution | Medium | Same weakness, CWE-415 |
| CVE-2026-33824 Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. | Critical Known exploited | Same weakness, CWE-415 |
| CVE-2025-62215 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate… | High Known exploited | Same weakness, CWE-415 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor