GHSA-c8v3-jhv9-4ppc: Use-after-free when setting the locale

January 23, 2024

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc<String>. The locale can be read with AtomicStr::as_str(). AtomicStr::as_str() does not increment the usage counter of the Arc.

If the locale is changed in one thread, another thread can have a stale – possibly already freed – reference to the stored string.

References

github.com/advisories/GHSA-c8v3-jhv9-4ppc
github.com/longbridgeapp/rust-i18n
github.com/longbridgeapp/rust-i18n/commit/22e0609591a2c08930f52a0e6bc860f02a0e88c0
github.com/longbridgeapp/rust-i18n/issues/71
rustsec.org/advisories/RUSTSEC-2024-0007.html

Code Behaviors & Features

Detect and mitigate GHSA-c8v3-jhv9-4ppc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →