rust-crossbeam-deque: race condition may lead to double free

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

Arbitrary Code Execution

crossbeam-deque is vulnerable to remote code execution. The vulnerability exists due to a race condition in the "Stealer::steal", "Stealer::stealbatch" and "Stealer::stealbatchandpop" functions. A remote attacker can exploit the race and gain unauthorized access to sensitive information...

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5107-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5107-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could...

crossbeam-deque Data Race before v0.7.4 and v0.8.1

Impact In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, th...

a2 (0.3.6), aerospike (0.3.0) +193 more potentially affected by CVE-2021-32810 via crossbeam-deque (>=0.1.1, <=0.6.3)

crossbeam-deque CARGO version =0.1.1, =0.2.5, =0.11.0, =0.2.0, =0.6.0, =0.5.0, =0.4.0, =0.5.0, =0.6.0, =0.3.0, =0.6.0, =0.7.0, =0.3.0, =0.6.0 and more Source cves: CVE-2021-32810 Source advisory: OSV:GHSA-PQQP-XMHJ-WGCW...

GHSA-PQQP-XMHJ-WGCW crossbeam-deque Data Race before v0.7.4 and v0.8.1

Impact In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, th...

GHSA-P9GF-GMFV-398M Double free in slice-deque

An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drainfilter upon a panic in a predicate function...

aurelius (>=0.7.0, <=0.7.5), basiliq (>=0.1.0, <=0.1.2) +23 more potentially affected by CVE-2021-29938 via slice-deque (>=0.1.16, <=0.2.4)

slice-deque CARGO version =0.1.16, =0.7.0, =0.1.0, =0.7.0, =0.1.0, =0.13.1, =0.1.2, =0.9.0, =0.1.0, =0.2.0, =0.1.1, =0.1.0, =1.2.0 and more Source cves: CVE-2021-29938 Source advisory: OSV:GHSA-P9GF-GMFV-398M...

buf-ref-reader (0.3.0), buf_redux (>=0.7.0, <=0.8.1) +9 more potentially affected by CVE-2019-15543 via slice-deque (0.1.16)

slice-deque CARGO version 0.1.16 is affected by a known vulnerability. The following packages have a transitive dependency on slice-deque and may be impacted: - buf-ref-reader 0.3.0 - bufredux =0.7.0, =0.1.0, =0.2.0, =0.1.0, =0.12.0, =0.14.0 - reactive-rs 0.1.1 - rtplot 0.2.0 - seqio 0.3.0 -...

Out of bounds write in slice-deque

Affected versions of this crate entered a corrupted state if mem::sizeof:: % allocationgranularity != 0 and a specific allocation pattern was used: sufficiently shifting the deque elements over the mirrored page boundary. This allows an attacker that controls controls both element insertion and...

GHSA-C3M3-C39Q-PV23 Out of bounds write in slice-deque

Affected versions of this crate entered a corrupted state if mem::sizeof:: % allocationgranularity != 0 and a specific allocation pattern was used: sufficiently shifting the deque elements over the mirrored page boundary. This allows an attacker that controls controls both element insertion and...

Memory corruption slice-deque

Affected versions of this crate did not properly update the head and tail of the deque when inserting and removing elements from the front if, before insertion or removal, the tail of the deque was in the mirrored memory region, and if, after insertion or removal, the head of the deque is exactly...

GHSA-HR3C-6MMP-6M39 Memory corruption slice-deque

Affected versions of this crate did not properly update the head and tail of the deque when inserting and removing elements from the front if, before insertion or removal, the tail of the deque was in the mirrored memory region, and if, after insertion or removal, the head of the deque is exactly...

CVE-2020-36452

An issue was discovered in the array-tools crate before 0.3.2 for Rust. FixedCapacityDequeLike::clone has a drop of uninitialized memory...

DEBIAN-CVE-2021-32810

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

CVE-2021-32810

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

CVE-2021-32810

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

CVE-2021-32810

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

CVE-2021-32810

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

UBUNTU-CVE-2021-32810

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...