Skip to content

`MsQueue` `push`/`pop` use the wrong orderings

Moderate severity GitHub Reviewed Published Jun 8, 2022 to the GitHub Advisory Database • Updated Jan 11, 2023

Package

cargo crossbeam (Rust)

Affected versions

< 0.3.0

Patched versions

0.3.0

Description

Affected versions of this crate use orderings which are too weak to support this data structure.
It is likely this has caused memory corruption in the wild: crossbeam-rs/crossbeam#97 (comment).

References

Published to the GitHub Advisory Database Jun 8, 2022
Reviewed Jun 8, 2022
Last updated Jan 11, 2023

Severity

Moderate

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-rwf4-gx62-rqfw
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.