CVE-2021-28031: move_elements can double-free objects on panic

May 24, 2022 (updated June 13, 2023)

Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding.

The flaw was fixed in commit 891561bea by removing the unsafe block and using a plain iterator.

References

github.com/advisories/GHSA-3qm2-rfqw-fmrw
github.com/okready/scratchpad
github.com/okready/scratchpad/commit/891561bea
github.com/okready/scratchpad/issues/1
nvd.nist.gov/vuln/detail/CVE-2021-28031
rustsec.org/advisories/RUSTSEC-2021-0030.html

Code Behaviors & Features

Detect and mitigate CVE-2021-28031 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →