GHSA-fhvj-7f9p-w788CriticalCVSS 9.8

Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr

Published
August 25, 2021
Last Modified
June 13, 2023

🔗 CVE IDs covered (1)

📋 Description

arr crate contains multiple security issues. Specifically,

  1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
  2. Index and IndexMut implementation does not check the array bound.
  3. Array::new_from_template() drops uninitialized memory.

🎯 Affected products1

  • rust/arr:<= 0.6.1

🔗 References (4)