Medium, CVSS 6.9crates.ioPublished
rkyv: Panic safety bugs in InlineVec::clear and SerVec::clear enable arbitrary code execution
GHSA-vfvv-c25p-m7mm
- Affected
- crates.io rkyv >= 0.8.0, < 0.8.16
- Fixed in
- 0.8.16· Vendor fix available
- Issue
- InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe. Both functions iterate over their elements and call dropinplace on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value. A subsequent invocation of clear() on the same container then re-visits the already-freed elements: - InlineVec::clear() is called again from InlineVec's own Drop implementation when the value is later dropped. - SerVec::clear() is called again by SerVec::withcapacity() after the user closure returns. Technical Impact - CWE-415 (Double Free): Heap corruption when element type holds Box<T - CWE-416 (Use-After-Free): Memory corruption when element reads from heap during Drop Both vulnerabilities are triggerable entirely from safe Rust via std::panic::catchunwind and require no special privileges.
Recommended action: Upgrade to 0.8.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.