Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

oneringbuf

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3crates.ioPublished

    OneRingBuf has a Use After Free Vulnerability

    GHSA-q95x-7g78-rccv

    Affected
    • crates.io oneringbuf < 0.8.0
    Fixed in
    0.8.0· Vendor fix available
    Issue
    Affected versions of oneringbuf exposed the obsolete IntoRef::intoref method through the public IntoRef trait. For heap-backed ring buffers, this method returned a DroppableRef handle. DroppableRef stored an owning raw pointer created from Box::intoraw. Its Clone implementation copied this raw pointer without incrementing the internal aliveiters counter. Internally, this clone pattern appears to rely on a fixed number of handles being created to match the initial aliveiters value. However, exposing DroppableRef through the public IntoRef::TargetRef associated type allows safe external code to create additional clones beyond that fixed count, breaking the lifetime protocol. Drop later dereferenced the pointer and could free the backing allocation with Box::fromraw. Safe code could call IntoRef::intoref to obtain a DroppableRef and then clone it. Each clone pointed to the same allocation, but the internal aliveiters counter was not increased. As a result, one clone could free the…

    Recommended action: Upgrade to 0.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →