Reported

June 7, 2022

Issued

June 8, 2022 (last modified: June 13, 2023)

Package

crossbeam (crates.io)

Type

Vulnerability

Categories

• thread-safety
• memory-corruption

Aliases

• GHSA-rwf4-gx62-rqfw

References

• https://github.com/crossbeam-rs/crossbeam/pull/98

Patched

• >=0.3.0

Description

Affected versions of this crate use orderings which are too weak to support this data structure. It is likely this has caused memory corruption in the wild: https://github.com/crossbeam-rs/crossbeam/issues/97#issuecomment-412785919.

Advisory available under CC0-1.0 license.