crossbeam known bugs

cargo

6 known bugs in crossbeam, with affected versions, fixes and workarounds. Sourced from upstream issue trackers.

6
bugs
Known bugs
SeverityAffectedFixed inTitleStatusSource
medium0.0.0-00.3.0
`MsQueue` `push`/`pop` use the wrong orderings
Affected versions of this crate use orderings which are too weak to support this data structure. It is likely this has caused memory corruption in the wild: <https://github.com/crossbeam-rs/crossbeam/issues/97#issuecomment-412785919>.
fixedosv:RUSTSEC-2022-0029
medium0.0.0-00.7.0
`SegQueue` creates zero value of any type
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null). The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.
fixedosv:RUSTSEC-2022-0020
medium0.4.00.4.1
MsQueue and SegQueue suffer from double-free
Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees. The flaw was corrected by wrapping elements inside queues in a `ManuallyDrop`. Thanks to @c0gent for reporting the issue.
fixedosv:RUSTSEC-2018-0009
mediumany0.3.0
`MsQueue` `push`/`pop` use the wrong orderings
Affected versions of this crate use orderings which are too weak to support this data structure. It is likely this has caused memory corruption in the wild: <https://github.com/crossbeam-rs/crossbeam/issues/97#issuecomment-412785919>.
fixedosv:GHSA-rwf4-gx62-rqfw
mediumany0.7.0
`SegQueue` creates zero value of any type
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null). The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.
fixedosv:GHSA-8gj8-hv75-gp94
critical0.4.00.4.1
Double free in crossbeam
Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees. The flaw was corrected by wrapping elements inside queues in a ManuallyDrop.
fixedosv:GHSA-c3cw-c387-pj65
API access

Get this data programmatically \u2014 free, no authentication.

curl https://depscope.dev/api/bugs/cargo/crossbeam
crossbeam bugs — known issues per version | DepScope | DepScope