GHSA-5j8w-r7g8-5472 Arrow2 allows double free in `safe` code
A double free vulnerability in the Arrow2 Rust library allows attackers to cause a segmentation fault and denial of service via cloning specific structs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5j8w-r7g8-5472?
GHSA-5j8w-r7g8-5472 is an use after free vulnerability in arrow2, published on 4 Mar 2022.
Official description
The struct Ffi_ArrowArray implements #derive(Clone) that is inconsistent with
its custom implementation of Drop, resulting in a double free when cloned.
Cloning this struct in safe results in a segmentation fault, which is unsound.
This derive was removed from this struct. All users are advised to either:
- bump the patch version of this crate (for versions
v0.7,v0.8,v0.9), or - migrate to a more recent version of the crate (when using
<0.7).
Doing so elimitates this vulnerability (code no longer compiles).
Which versions are affected by GHSA-5j8w-r7g8-5472?
7 open source packages ship an affected version, including arrow2.
| Package | Affected | Fixed in |
|---|---|---|
arrow2 crates.io | All versions | 0.7.1 |
arrow2 crates.io | All versions | 0.7.1 |
arrow2 crates.io | From 0.0.0-0 | 0.7.1, 0.8.2, 0.9.2, 0.10.0 |
arrow2 crates.io | From 0.8.0 | 0.8.2 |
arrow2 crates.io | From 0.8.0 | 0.8.2 |
arrow2 crates.io | From 0.9.0 | 0.9.2 |
1 more packages
arrow2 crates.io | From 0.9.0 | 0.9.2 |
How do I fix GHSA-5j8w-r7g8-5472?
Upgrade arrow2 to a fixed version for your release line: 0.7.1, 0.8.2, 0.9.2 or 0.10.0.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-5j8w-r7g8-5472 being exploited?
There is no known exploitation of GHSA-5j8w-r7g8-5472 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2022-0012.