PkgSeer

Vulnerability GHSA-pqqp-xmhj-wgcw

Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
5 years ago
August 25, 2021 at 09:01 PM UTC
crossbeam-deque Data Race before v0.7.4 and v0.8.1
0.1.0 - 0.7.3 and 0.8.0
0.1.0 - 0.7.3 and 0.8.0

Summary

crossbeam-deque Data Race before v0.7.4 and v0.8.1

Details

Impact

In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug.

Crates using Stealer::steal, Stealer::steal_batch, or Stealer::steal_batch_and_pop are affected by this issue.

Patches

This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

Credits

This issue was reported and fixed by Maor Kleinberger.

License

This advisory is in the public domain.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Critical
5 years ago
Data race in crossbeam-deque
0.1.0 - 0.7.3 and 0.8.0 RUSTSEC-2021-0093
0.1.0 - 0.7.3 and 0.8.0 RUSTSEC-2021-0093
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
5 years ago
August 25, 2021 at 09:01 PM UTC
Fixed (0.8.1)
5 years ago
July 30, 2021 at 10:33 PM UTC
Fixed (0.7.4)
5 years ago
July 30, 2021 at 10:35 PM UTC
Last Modified
3 months ago
July 08, 2026 at 06:28 AM UTC