pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from `alloc::sync::Arc` and `alloc::rc::Rc`, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes. This projected pointer could cause the original `Arc`'s or `Rc`'s `Drop::drop` to get called at a point where the original data was no longer valid, leading to a potential use after free. The affected functions were - `pared::prc::Prc::from_rc` - `pared::prc::Prc::project` - `pared::prc::Prc::try_from_rc` - `pared::sync::Parc::from_arc` - `pared::sync::Parc::project` - `pared::sync::Parc::try_from_arc` This flaw was fixed in [108f540ea8acb6073751a1aa386085c1cdc4fd1e](https://github.com/radekvit/pared/commit/108f540ea8acb6073751a1aa386085c1cdc4fd1e) by requiring that the type stored in the `Arc`s and `Rc`s passed to these functions contain `T: 'static`.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pared (crates.io) | before 0.4.0 | 0.4.0 | Patch available | GHSA-vgmh-mqm4-8j88 |
- pared (crates.io) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-vgmh-mqm4-8j88
Remediation
- Fix · GHSA-vgmh-mqm4-8j88 pared (crates.io) Fixed in 0.4.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-vgmh-mqm4-8j88
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences