Unratedcrates.ioPublished
use-after-free in tracing
GHSA-8f24-6m29-wm2r
- Affected
- crates.io tracing >= 0.1.38, < 0.1.40
- Fixed in
- 0.1.40· Vendor fix available
- Issue
- The implementation of the [Instrumented::intoinner] method in affected versions of this crate contains undefined behavior due to incorrect use of [std::mem::forget] The function creates const pointers to self, calls [mem::forget(self)][std::mem::forget], and then moves values out of those pointers using [std::ptr::read]. However, the [mem::forget documentation][std::mem::forget] states: Any resources the value manages, such as heap memory or a file handle, will linger forever in an unreachable state. However, it does not guarantee that pointers to this memory will remain valid. This means that these pointers are no longer valid. This could result in a stack use-after-free if LLVM chooses to reuse self's stack slot for a rebinding after the call to [std::mem::forget]. This undefined behavior has not been observed to cause miscompilation as of Rust 1.73.0. However, any use of this method with the affected versions of tracing are unsound. The flaw was corrected in commit [20a1762] (PR…
Recommended action: Upgrade to 0.1.40 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.