Skip to content
Fencer Intel
high —

GHSA-5j8w-r7g8-5472 json

Arrow2 allows double free in `safe` code

published 4y ago modified 3y ago also RUSTSEC-2022-0012

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with its custom implementation of `Drop`, resulting in a double free when cloned.

Cloning this struct in `safe` results in a segmentation fault, which is unsound.

This derive was removed from this struct. All users are advised to either: * bump the patch version of this crate (for versions `v0.7,v0.8,v0.9`), or * migrate to a more recent version of the crate (when using `<0.7`).

Doing so elimitates this vulnerability (code no longer compiles).

Patch / fix

  • crates.io arrow2 0.7.1, 0.8.2, 0.9.2, 0.10.0

Is GHSA-5j8w-r7g8-5472 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io arrow2
<0.7.1
>=0.8.0, <0.8.2
>=0.9.0, <0.9.2
>=0.0.0-0, <0.7.1
>=0.10.0, <0.10.0
0.7.1
0.8.2
0.9.2
0.10.0

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.