GHSA-QC84-GQF4-9926 crossbeam-utils Unsoundness of AtomicCell<{i,u}64> arithmetics on 32-bit targets that support Atomic{I,U}64

🗓️ 16 Feb 2022 22:36:21Reported by GoogleType

osv

osv🔗 osv.dev👁 23 Views

Crossbeam-utils vulnerability in `AtomicCell<{i,u}64}` fetch method

Reporter	Title	Published	Views	Family All 32
AstraLinux	Astra Linux – Vulnerability in RustC	20 May 202605:53	–	astralinux
Tenable Nessus	Azure Linux 3.0 Security Update: librsvg2 (CVE-2022-23639)	22 Jan 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2022-23639	5 Mar 202500:00	–	nessus
BDU FSTEC	The vulnerability of Crossbeam Utils, a parallel programming tool, on 32-bit systems arises from the simultaneous execution using a shared resource with improper synchronization. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.	23 Sep 202200:00	–	bdu_fstec
CBLMariner	CVE-2022-23639 affecting package librsvg2 for versions less than 2.58.1-1	21 Jun 202409:32	–	cbl_mariner
CBLMariner	CVE-2022-23639 affecting package rpm-ostree for versions less than 2024.4-1	24 Jul 202401:44	–	cbl_mariner
CBLMariner	CVE-2022-23639 affecting package rust for versions less than crossbeam_utils-0.8.7	5 May 202515:41	–	cbl_mariner
Circl	CVE-2022-23639	15 Feb 202222:34	–	circl
CNNVD	crossbeam 竞争条件问题漏洞	15 Feb 202200:00	–	cnnvd
CVE	CVE-2022-23639	15 Feb 202218:20	–	cve

Source	Link
github	www.github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-23639
github	www.github.com/crossbeam-rs/crossbeam/pull/781
github	www.github.com/crossbeam-rs/crossbeam
github	www.github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7
rustsec	www.rustsec.org/advisories/RUSTSEC-2022-0041.html

04 Feb 2025 17:30Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18.1

EPSS0.01239

race condition alignment data access memory atomiccell 32-bit 64-bit patch github public domain crossbeam-utils