GitStock

xacrimon/dyn-future · Security

DynFuture Drop Can Construct a Dangling Reference

Open GitHub
GHSA ID
GHSA-j3w3-p6mr-3hrh
Severity
medium
Published
Updated
CVSS v4
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata.

This issue was reproduced against dyn-future 3.0.4 under Miri. The crate is unmaintained.

CWEs

  • CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')

References