From b1db690d83c12237b6142f78de9b422324717a1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Kijewski?= Date: Tue, 23 Jan 2024 15:13:25 +0100 Subject: [PATCH] rust-i18n-support: Use-after-free when setting the locale (#1855) --- crates/rust-i18n-support/RUSTSEC-0000-0000.md | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 crates/rust-i18n-support/RUSTSEC-0000-0000.md diff --git a/crates/rust-i18n-support/RUSTSEC-0000-0000.md b/crates/rust-i18n-support/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..4c7746129 --- /dev/null +++ b/crates/rust-i18n-support/RUSTSEC-0000-0000.md @@ -0,0 +1,30 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "rust-i18n-support" +date = "2024-01-19" +url = "https://github.com/longbridgeapp/rust-i18n/issues/71" +informational = "unsound" +categories = ["memory-exposure"] +references = [ + "https://github.com/longbridgeapp/rust-i18n/pull/72", + "https://github.com/longbridgeapp/rust-i18n/releases/tag/v3.0.1", +] + +[affected] +functions = { "rust_i18n_support::AtomicStr::as_str" = ["< 3.0.1, >= 3.0.0"] } + +[versions] +patched = [">= 3.0.1"] +unaffected = ["< 3.0.0"] +``` + +# Use-after-free when setting the locale + +Version 3.0.0 introduced an `AtomicStr` type, that is used to store the current locale. +It stores the locale as a raw pointer to an `Arc`. +The locale can be read with `AtomicStr::as_str()`. +`AtomicStr::as_str()` does not increment the usage counter of the `Arc`. + +If the locale is changed in one thread, another thread can have a stale -- possibly already freed -- +reference to the stored string.