PT-2025-12722 · Crates.Io · Pared

Published 2025-03-24 · Updated 2025-03-24

OSV

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could outlive original data's lifetimes.

This projected pointer could cause the original Arc's or Rc's Drop::drop to get called at a point where the original data was no longer valid, leading to a potential use after free.

The affected functions were

• pared::prc::Prc::from rc
• pared::prc::Prc::project
• pared::prc::Prc::try from rc
• pared::sync::Parc::from arc
• pared::sync::Parc::project
• pared::sync::Parc::try from arc

This flaw was fixed in 108f540ea8acb6073751a1aa386085c1cdc4fd1e by requiring that the type stored in the Arcs and Rcs passed to these functions contain T: 'static.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

GHSA-VGMH-MQM4-8J88

Affected Products

Pared

References · 5

• https://osv.dev/vulnerability/GHSA-vgmh-mqm4-8j88 · Vendor Advisory
• https://github.com/radekvit/pared · Note
• https://github.com/radekvit/pared/issues/2 · Note
• https://github.com/radekvit/pared/commit/108f540ea8acb6073751a1aa386085c1cdc4fd1e · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0016.html · Note