GHSA-mpg5-fvwp-42m2 Unsoundness in `dashmap` references
A memory safety flaw in the dashmap Rust library allows references to outlive locks, causing undefined behavior and potential application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-mpg5-fvwp-42m2?
GHSA-mpg5-fvwp-42m2 is a memory corruption vulnerability in dashmap, published on 10 Jan 2022.
Official description
Reference returned by some methods of Ref (and similar types) may outlive the Ref and escape the lock.
This causes undefined behavior and may result in a segfault.
More information in dashmap#167 issue.
Which versions are affected by GHSA-mpg5-fvwp-42m2?
3 open source packages ship an affected version, including dashmap.
| Package | Affected | Fixed in |
|---|---|---|
dashmap crates.io | From 5.0.0 | 5.1.0 |
dashmap crates.io | From 5.0.0 | 5.1.0 |
dashmap crates.io | From 5.0.0 | 5.1.0 |
How do I fix GHSA-mpg5-fvwp-42m2?
Upgrade dashmap to 5.1.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-mpg5-fvwp-42m2 being exploited?
There is no known exploitation of GHSA-mpg5-fvwp-42m2 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2022-0002.