Read the docs
TI-2022-26555 Aliases GHSA-5j8w-r7g8-5472

Arrow2 allows double free in `safe` code

Priority LOW 38CWE-415Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with its custom implementation of `Drop`, resulting in a double free when cloned. Cloning this struct in `safe` results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to either: * bump the patch version of this crate (for versions `v0.7,v0.8,v0.9`), or * migrate to a more recent version of the crate (when using `<0.7`). Doing so elimitates this vulnerability (code no longer compiles).

Why it matters now

Fix Fixed arrow2 (crates.io): 0.7.1, 0.8.2, 0.9.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—arrow2 (crates.io)before 0.7.10.7.1Patch availableGHSA-5j8w-r7g8-5472
—arrow2 (crates.io)0.8.0 to before 0.8.20.8.2Patch availableGHSA-5j8w-r7g8-5472
—arrow2 (crates.io)0.9.0 to before 0.9.20.9.2Patch availableGHSA-5j8w-r7g8-5472
  • arrow2 (crates.io) Vendor— Affected before 0.7.1 Fixed in 0.7.1 Patch available GHSA-5j8w-r7g8-5472
  • arrow2 (crates.io) Vendor— Affected 0.8.0 to before 0.8.2 Fixed in 0.8.2 Patch available GHSA-5j8w-r7g8-5472
  • arrow2 (crates.io) Vendor— Affected 0.9.0 to before 0.9.2 Fixed in 0.9.2 Patch available GHSA-5j8w-r7g8-5472

Remediation

  • Fix · GHSA-5j8w-r7g8-5472 arrow2 (crates.io) Fixed in 0.7.1 Advisory →
  • Fix · GHSA-5j8w-r7g8-5472 arrow2 (crates.io) Fixed in 0.8.2 Advisory →
  • Fix · GHSA-5j8w-r7g8-5472 arrow2 (crates.io) Fixed in 0.9.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-5j8w-r7g8-5472

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences