{"answers":{"affected":"3 open source packages ship an affected version, including tracing.","exploited":"There is no known exploitation of GHSA-8f24-6m29-wm2r in the wild and no public exploit code.","fix":"Upgrade tracing to 0.1.40 or later.","what":"GHSA-8f24-6m29-wm2r is an use after free vulnerability in tracing, published on 19 Oct 2023."},"fix_prompt":"Check this codebase for GHSA-8f24-6m29-wm2r and fix it if it is affected.\n\nWhat it is: GHSA-8f24-6m29-wm2r is an use after free vulnerability in tracing, published on 19 Oct 2023. \nExploitation: There is no known exploitation of GHSA-8f24-6m29-wm2r in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- tracing (crates.io): affected from 0.1.38; fixed in 0.1.40\n- tracing (crates.io): affected from 0.1.38; fixed in 0.1.40\n- tracing (crates.io): affected from 0.1.38-0; fixed in 0.1.40\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-8f24-6m29-wm2r/ (Markdown: https://insights.sbomify.com/GHSA-8f24-6m29-wm2r/index.md)","id":"GHSA-8f24-6m29-wm2r","markdown":"https://insights.sbomify.com/GHSA-8f24-6m29-wm2r/index.md","name":"GHSA-8f24-6m29-wm2r","record":{"aliases":["RUSTSEC-2023-0078"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust tracing library","requires_auth":"none","summary":"A use-after-free vulnerability in the Rust tracing library allows attackers to potentially execute arbitrary code or cause crashes via undefined behavior in Instrumented::into_inner.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The implementation of the [`Instrumented::into_inner`] method in affected versions of this crate contains undefined behavior due to incorrect use of [`std::mem::forget`] The function creates `*const` pointers to `self`, calls [`mem::forget(self)`][`std::mem::forget`], and then moves values out of those pointers using [`std::ptr::read`].\n\n```rust\n// To manually destructure `Instrumented` without `Drop`, we\n// move it into a ManuallyDrop and use pointers to its fields\nlet span: *const Span = \u0026this.span;\nlet inner: *const ManuallyDrop\u003cT\u003e = \u0026this.inner;\nmem::forget(self);\n// SAFETY: Those pointers are valid for reads, because `Drop` didn't\n//         run, and properly aligned, because `Instrumented` isn't\n//         `#[repr(packed)]`.\nlet _span = unsafe { span.read() };\nlet inner = unsafe { inner.read() };\n```\n\nHowever, the [`mem::forget` documentation][`std::mem::forget`] states:\n\n\u003e Any resources the value manages, such as heap memory or a file handle, will\n\u003e linger forever in an unreachable state. **However, it does not guarantee that\n\u003e pointers to this memory will remain valid.**\n\nThis means that these pointers are no longer valid. This could result in a stack use-after-free if LLVM chooses to reuse `self`'s stack slot for a rebinding after the call to [`std::mem::forget`].\n\nThis undefined behavior has not been observed to cause miscompilation as of Rust 1.73.0. However, any use of this method with the affected versions of `tracing` are unsound.\n\nThe flaw was corrected in commit [20a1762] ([PR #2765]) by replacing the use of [`std::mem::forget`] with `std::mem::ManuallyDrop`, ensuring that the stack slot is not reused and the pointers remain valid when they are read. The fix is\npublished in `tracing` [v0.1.40]. Affected versions have been yanked from crates.io.\n\nThanks to [Taylor Cramer] and [Manish Goregaokar] for finding and correcting\nthis issue!\n\n[`Instrumented::into_inner`]:\n    https://docs.rs/tracing/latest/tracing/instrument/struct.Instrumented.html#method.into_inner\n[`std::mem::forget`]: https://doc.rust-lang.org/std/mem/fn.forget.html\n[`std::ptr::read`]:\n    https://doc.rust-lang.org/std/primitive.pointer.html#method.read-1\n[20a1762]:\n    https://github.com/tokio-rs/tracing/commit/20a1762b3fd5f1fafead198fd18e469c68683721\n[PR #2765]: https://github.com/tokio-rs/tracing/pull/2765\n[v0.1.40]: https://crates.io/crates/tracing/0.1.40\n[Taylor Cramer]: https://github.com/cramertj\n[Manish Goregaokar]: https://github.com/manishearth","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"use-after-free in tracing","id":"GHSA-8f24-6m29-wm2r","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"use_after_free","year":"2023"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.1.40"],"introduced":["0.1.38"],"last_affected":[],"package":"tracing","purl":null,"source":"GHSA-8f24-6m29-wm2r"},{"ecosystem":"crates.io","fixed":["0.1.40"],"introduced":["0.1.38"],"last_affected":[],"package":"tracing","purl":"pkg:cargo/tracing","source":"GHSA-8f24-6m29-wm2r"},{"ecosystem":"crates.io","fixed":["0.1.40"],"introduced":["0.1.38-0"],"last_affected":[],"package":"tracing","purl":"pkg:cargo/tracing","source":"RUSTSEC-2023-0078"}],"products":null,"published":"2023-10-19","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A use-after-free vulnerability in the Rust tracing library allows attackers to potentially execute arbitrary code or cause crashes via undefined behavior in Instrumented::into_inner.","url":"https://insights.sbomify.com/GHSA-8f24-6m29-wm2r/"}