{"answers":{"affected":"3 open source packages ship an affected version, including cell-project.","exploited":"There is no known exploitation of GHSA-p75v-367r-2v23 in the wild and no public exploit code.","fix":"Upgrade cell-project to 0.1.4 or later.","what":"GHSA-p75v-367r-2v23 is a memory corruption vulnerability in cell-project, published on 27 Aug 2020."},"fix_prompt":"Check this codebase for GHSA-p75v-367r-2v23 and fix it if it is affected.\n\nWhat it is: GHSA-p75v-367r-2v23 is a memory corruption vulnerability in cell-project, published on 27 Aug 2020. \nExploitation: There is no known exploitation of GHSA-p75v-367r-2v23 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- cell-project (crates.io): affected all versions; fixed in 0.1.4\n- cell-project (crates.io): affected all versions; fixed in 0.1.4\n- cell-project (crates.io): affected from 0.0.0-0; fixed in 0.1.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-p75v-367r-2v23/ (Markdown: https://insights.sbomify.com/GHSA-p75v-367r-2v23/index.md)","id":"GHSA-p75v-367r-2v23","markdown":"https://insights.sbomify.com/GHSA-p75v-367r-2v23/index.md","name":"GHSA-p75v-367r-2v23","record":{"aliases":["RUSTSEC-2020-0164"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust cell-project library","requires_auth":"none","summary":"A Rust library vulnerability allows memory corruption via incorrect variance handling, potentially leading to code execution.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Overview\n\nThe issue lies in the implementation of the `cell_project` macro which used `field as *const _` instead of `field as *mut _`.\nThe problem being that `*const T` is covariant in `T` while `*mut T` is invariant in `T`. Keep in mind that `\u0026Cell\u003cT\u003e` is invariant in `T`,\nso casting to `*const T` relaxed the variance, and lead to unsoundness, as shown in the example below.\n\n```rs\nuse std::cell::Cell;\nuse cell_project::cell_project as cp;\n\nstruct Foo\u003c'a\u003e {\n    x: Option\u003c\u0026'a Cell\u003cFoo\u003c'a\u003e\u003e\u003e,\n}\n\nimpl\u003c'a\u003e Drop for Foo\u003c'a\u003e {\n    fn drop(\u0026mut self) {\n        // `ourselves` is an \u0026Cell\u003cSelf\u003e.\n        // NB: `Drop` is unsound.\n        if let Some(ourselves) = self.x.as_ref() {\n            // replace `self` (but this doesn't actually replace `self`)\n            let is_x_none = ourselves.replace(Foo {\n                x: None,\n            }).x.as_ref().is_none();\n            // if we just moved out of `self`, and we had a `Some` originally,\n            // how come this is a `None`?\n            if is_x_none {\n                println!(\"how did we get a None?\");\n            }\n        }\n    }\n}\n\nfn main() {\n    let foo = Cell::new(Foo {\n        x: None,\n    });\n    let x = cp!(Foo\u003c'_\u003e, foo.x);\n    x.set(Some(\u0026foo));\n}\n```\n\n### MIRI error\n\n```rs\n$ cargo +nightly miri run\n    Finished dev [unoptimized + debuginfo] target(s) in 0.01s\n     Running `\u003csnip\u003e`\nerror: Undefined Behavior: not granting access to tag \u003cuntagged\u003e because incompatible item is protected: [Unique for \u003c2472\u003e (call 796)]\n   --\u003e $RUST_STD_PATH/src/rust/library/core/src/cell.rs:404:31\n    |\n404 |         mem::replace(unsafe { \u0026mut *self.value.get() }, val)\n    |                               ^^^^^^^^^^^^^^^^^^^^^^ not granting access to tag \u003cuntagged\u003e because incompatible item is protected: [Unique for \u003c2472\u003e (call 796)]\n    |\n    = help: this indicates a potential bug in the program: it performed an invalid operation, but the rules it violated are still experimental\n    = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information\n\n    = note: inside `std::cell::Cell::\u003cFoo\u003e::replace` at $RUST_STD_PATH/src/rust/library/core/src/cell.rs:404:31\nnote: inside `\u003cFoo as std::ops::Drop\u003e::drop` at src/main.rs:14:29\n   --\u003e src/main.rs:14:29\n    |\n14  |               let is_x_none = ourselves.replace(Foo {\n    |  _____________________________^\n15  | |                 x: None,\n16  | |             }).x.as_ref().is_none();\n    | |______________^\n    = note: inside `std::ptr::drop_in_place::\u003cFoo\u003e - shim(Some(Foo))` at $RUST_STD_PATH/src/rust/library/core/src/ptr/mod.rs:486:1\n    = note: inside `std::ptr::drop_in_place::\u003cstd::cell::UnsafeCell\u003cFoo\u003e\u003e - shim(Some(std::cell::UnsafeCell\u003cFoo\u003e))` at $RUST_STD_PATH/src/rust/library/core/src/ptr/mod.rs:486:1\n    = note: inside `std::ptr::drop_in_place::\u003cstd::cell::Cell\u003cFoo\u003e\u003e - shim(Some(std::cell::Cell\u003cFoo\u003e))` at $RUST_STD_PATH/src/rust/library/core/src/ptr/mod.rs:486:1\nnote: inside `main` at src/main.rs:32:1\n   --\u003e src/main.rs:32:1\n    |\n32  | }\n    | ^\n\nnote: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace\n\nerror: aborting due to previous error\n```\n\n## Affected Versions\n\nAll versions of the cell-project crate before `0.1.4` are affected.\n\n## Mitigation\n\nThis was fixed in [Issues/4], and released as version `0.1.4`.\nSo just updating to the latest version will include the fix (which may result in a compile error on unsound usage).\n\n## Acknowledgements\n\nThis was discovered and fixed by [@SoniEx2](https://github.com/SoniEx2) in cell-project: [Issues/3] and [Issues/4]\n\n[issues/3]: https://github.com/RustyYato/cell-project/issues/3\n[issues/4]: https://github.com/RustyYato/cell-project/issues/4","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"`cell-project` used incorrect variance when projecting through `\u0026Cell\u003cT\u003e`","id":"GHSA-p75v-367r-2v23","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"memory_corruption","year":"2020"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.1.4"],"introduced":["0"],"last_affected":[],"package":"cell-project","purl":null,"source":"GHSA-p75v-367r-2v23"},{"ecosystem":"crates.io","fixed":["0.1.4"],"introduced":["0"],"last_affected":[],"package":"cell-project","purl":"pkg:cargo/cell-project","source":"GHSA-p75v-367r-2v23"},{"ecosystem":"crates.io","fixed":["0.1.4"],"introduced":["0.0.0-0"],"last_affected":[],"package":"cell-project","purl":"pkg:cargo/cell-project","source":"RUSTSEC-2020-0164"}],"products":null,"published":"2020-08-27","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A Rust library vulnerability allows memory corruption via incorrect variance handling, potentially leading to code execution.","url":"https://insights.sbomify.com/GHSA-p75v-367r-2v23/"}