GHSA-cwvc-87xq-pc5mHighCVSS 8.1

Out-of-bounds Write and Race Condition in metrics-util

Published
January 6, 2022
Last Modified
June 13, 2023

🔗 CVE IDs covered (1)

📋 Description

In the affected versions of the crate, AtomicBucket unconditionally implements Send/Sync traits. Therefore, users can create a data race to the inner T: !Sync by using the AtomicBucket::data_with() API. Such data races can potentially cause memory corruption or other undefined behavior.

The flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct Block (which is a data type contained inside AtomicBucket).

🎯 Affected products1

  • rust/metrics-util:< 0.7.0

🔗 References (6)