GHSA-9g55-pg62-m8hh RUSTSEC-2022-0019
Channel creates zero value of any type
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.4.3- Upgrade crossbeam-channel to this version or later
Description
Affected versions of this crate called mem::zeroed() to create values of a user-supplied type T.
This is unsound e.g. if T is a reference type (which must be non-null).
The flaw was corrected by avoiding the use of mem::zeroed(), using MaybeUninit instead.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| crossbeam-channel | < 0.4.3 |
0.4.3 |
| crossbeam-channel | >= 0.0.0-0, < 0.4.3 |
0.4.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
crossbeam-channel crates.io → 0.4.3
- cargo
cargo update -p crossbeam-channel --precise 0.4.3
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pg9f-39pc-qf8g crossbeam-channel Vulnerable to Double Free on Drop | Medium | Also affects crossbeam-channel |
| GHSA-m8h8-v6jh-c762 Incorrect buffer size in crossbeam-channel | Medium | Also affects crossbeam-channel |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor