Skip to content
Log inStart free trial

GHSA-pg9f-39pc-qf8g CVE-2025-4574 RUSTSEC-2025-0024 TROVE-2025-013

crossbeam-channel Vulnerable to Double Free on Drop

Medium crates.io
Severity
0.0 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.56%
Chance of exploitation in the next 30 days. Higher than 46.88% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-415 Double Free
Fix
0.5.15
Upgrade crossbeam-channel to this version or later

Description

The internal Channel type's Drop method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption.

Quoting from the upstream description in merge request #1187:

The problem lies in the fact that dicard_all_messages contained two paths that could lead to head.block being read but only one of them would swap the value. This meant that dicard_all_messages could end up observing a non-null block pointer (and therefore attempting to free it) without setting head.block to null. This would then lead to Channel::drop making a second attempt at dropping the same pointer.

The bug was introduced while fixing a memory leak, in upstream MR #1084, first published in 0.5.12.

The fix is in upstream MR #1187 and has been published in 0.5.15

Affected versions

crates.io

PackageVulnerableFixed in
crossbeam-channel
>= 0.5.12, < 0.5.15
0.5.15
crossbeam-channel
>= 0.5.12-0, < 0.5.15
0.5.15

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

crossbeam-channel crates.io → 0.5.15

cargo
cargo update -p crossbeam-channel --precise 0.5.15

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
Low
Availability (vulnerable system)
Low
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Weakness

CWE-415: Double Free

The product calls free() twice on the same memory address.

How to prevent it
  • Architecture and Design: Choose a language that provides automatic memory management.
  • Implementation: Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
  • Implementation: Use a static analysis tool to find double free instances.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-9g55-pg62-m8hh
Channel creates zero value of any type
High Also affects crossbeam-channel
GHSA-m8h8-v6jh-c762
Incorrect buffer size in crossbeam-channel
Medium Also affects crossbeam-channel
GO-2026-4981
Crash when handling long CNAME response in net
High Same weakness, CWE-415
GHSA-vfvv-c25p-m7mm
rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
Medium Same weakness, CWE-415
CVE-2026-33824
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Critical Known exploited Same weakness, CWE-415
CVE-2025-62215
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate…
High Known exploited Same weakness, CWE-415
GHSA-7mcq-f592-pf7v
Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs
High Same weakness, CWE-415
GHSA-f49c-87jh-g47q
TensorFlow has double free in Fractional(Max/Avg)Pool
High Same weakness, CWE-415
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor