CVE-2022-23639 Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils

What is CVE-2022-23639?

CVE-2022-23639 is a high-severity vulnerability in crossbeam-rs crossbeam, published on 15 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.

Weakness: CWE-362

Which versions are affected by CVE-2022-23639?

3 open source packages ship an affected version, including crossbeam-utils. It affects 1 product.

Products include Crossbeam Project Crossbeam.

How do I fix CVE-2022-23639?

Upgrade crossbeam-utils to 0.8.7 or later.

Is CVE-2022-23639 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23639 exists.

Other vulnerabilities in crossbeam-rs crossbeam

• CVE-2021-32810 Data race in crossbeam-deque Critical 9.8
• CVE-2018-20996 Double free in crossbeam Critical 9.8
• CVE-2020-15254 Undefined Behavior in bounded Crossbeam channel High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-41454, AZL-44763, AZL-61381, DEBIAN-CVE-2022-23639, GHSA-qc84-gqf4-9926, RUSTSEC-2022-0041 and 1 more.