rustsec-2026-0284
Vulnerability from osv_rustsec
Two independent soundness problems, both reachable from safe Rust.
Map::into_iter drops builder (the caller-supplied hasher H) and incin by
hand, then commits the ownership transfer with mem::forget(self). H::drop is
user code and may panic. If it does, mem::forget(self) is skipped and the
still-live Map unwinds, whose field drop glue destroys builder a second
time. An empty map is enough — no entries or concurrency required.
SharedIncin::clear writes mem::uninitialized::<Arc<_>>() into self.inner
before taking the real Arc out. Arc has a validity invariant, so this is
undefined behaviour at the point of creation, with no panic or concurrency
involved. Between that write and the repairing one, self.inner also holds
garbage while self is still droppable, so an unwind from incin.clear() or
Arc::new decrements a refcount through an uninitialized pointer. The
make_shared_incin! macro is instantiated five times, so this covers queue,
stack, map, channel::spmc and channel::mpmc.
Impact
- CWE-415 (Double Free): the same allocation is freed twice.
- CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated
Drop. - CWE-908 (Use of Uninitialized Resource): an
Arcis constructed from uninitialized bytes.
Fix
No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"categories": [
"memory-corruption"
],
"cvss": null,
"informational": "unsound"
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [
"lockfree::channel::mpmc::SharedIncin::clear",
"lockfree::channel::spmc::SharedIncin::clear",
"lockfree::map::Map::into_iter",
"lockfree::map::SharedIncin::clear",
"lockfree::queue::SharedIncin::clear",
"lockfree::stack::SharedIncin::clear"
],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "lockfree",
"purl": "pkg:cargo/lockfree"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "Two independent soundness problems, both reachable from safe Rust.\n\n`Map::into_iter` drops `builder` (the caller-supplied hasher `H`) and `incin` by\nhand, then commits the ownership transfer with `mem::forget(self)`. `H::drop` is\nuser code and may panic. If it does, `mem::forget(self)` is skipped and the\nstill-live `Map` unwinds, whose field drop glue destroys `builder` a second\ntime. An empty map is enough \u2014 no entries or concurrency required.\n\n`SharedIncin::clear` writes `mem::uninitialized::\u003cArc\u003c_\u003e\u003e()` into `self.inner`\nbefore taking the real `Arc` out. `Arc` has a validity invariant, so this is\nundefined behaviour at the point of creation, with no panic or concurrency\ninvolved. Between that write and the repairing one, `self.inner` also holds\ngarbage while `self` is still droppable, so an unwind from `incin.clear()` or\n`Arc::new` decrements a refcount through an uninitialized pointer. The\n`make_shared_incin!` macro is instantiated five times, so this covers `queue`,\n`stack`, `map`, `channel::spmc` and `channel::mpmc`.\n\n## Impact\n\n* CWE-415 (Double Free): the same allocation is freed twice.\n* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.\n* CWE-908 (Use of Uninitialized Resource): an `Arc` is constructed from uninitialized bytes.\n\n## Fix\n\nNo fixed release is available. The crate has had no release since 2018-11-18 and\nthe maintainer has not responded to the report.",
"id": "RUSTSEC-2026-0284",
"modified": "2026-09-14T09:48:33Z",
"published": "2026-08-26T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/lockfree"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0284.html"
},
{
"type": "REPORT",
"url": "https://gitlab.com/bzim/lockfree/-/issues/7"
}
],
"related": [],
"severity": [],
"summary": "Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.