GHSA-vgmh-mqm4-8j88 pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints
A use-after-free vulnerability in the pared crate allows attackers to execute arbitrary code or cause denial of service via improper lifetime handling in Arc and Rc projections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-vgmh-mqm4-8j88?
GHSA-vgmh-mqm4-8j88 is an use after free vulnerability in pared, published on 13 Mar 2025.
Official description
Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.
This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.
The affected functions were
pared::prc::Prc::from_rcpared::prc::Prc::projectpared::prc::Prc::try_from_rcpared::sync::Parc::from_arcpared::sync::Parc::projectpared::sync::Parc::try_from_arc
This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.
Which versions are affected by GHSA-vgmh-mqm4-8j88?
3 open source packages ship an affected version, including pared.
| Package | Affected | Fixed in |
|---|---|---|
pared crates.io | All versions | 0.4.0 |
pared crates.io | All versions | 0.4.0 |
pared crates.io | From 0.0.0-0 | 0.4.0 |
How do I fix GHSA-vgmh-mqm4-8j88?
Upgrade pared to 0.4.0 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-vgmh-mqm4-8j88 being exploited?
There is no known exploitation of GHSA-vgmh-mqm4-8j88 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0016.