CVE-2021-29931: Double free in arenavec

August 25, 2021 (updated June 13, 2023)

Affected versions of this crate did not guard against potential panics that may happen from user-provided functions T::default() and T::drop().

Panic within T::default() leads to dropping uninitialized T, when it is invoked from common::Slice::<T, H>::new(). Panic within T::drop() leads to double drop of T, when it is invoked either from common::SliceVec::<T, H>::resize_with() or common::SliceVec::<T, H>::resize()

Either case causes memory corruption in the heap memory.

References

github.com/advisories/GHSA-955p-rc5h-hg6h
github.com/ibabushkin/arenavec
github.com/ibabushkin/arenavec/issues/1
nvd.nist.gov/vuln/detail/CVE-2021-29931
rustsec.org/advisories/RUSTSEC-2021-0040.html

Code Behaviors & Features

Detect and mitigate CVE-2021-29931 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →