Reported

January 23, 2022

Issued

January 24, 2022 (last modified: June 13, 2023)

Package

thread_local (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Aliases

• GHSA-9hpw-r23r-xgm5

References

• https://github.com/Amanieu/thread_local-rs/issues/33

Patched

• >=1.1.4

Description

In the affected version of this crate, {Iter, IterMut}::next used a weaker memory ordering when loading values than what was required, exposing a potential data race when iterating over a ThreadLocal's values.

Crates using Iter::next, or IterMut::next are affected by this issue.

Advisory available under CC0-1.0 license.