okready/scratchpad · Security
move_elements can double-free objects on panic
- GHSA ID
- GHSA-3qm2-rfqw-fmrw
- CVE ID
- CVE-2021-28031
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding.
The flaw was fixed in commit 891561bea by removing the unsafe block and using a plain iterator.
CWEs
- CWE-415 · Double Free