GitHub Advisoryadvisory · crates.io

GHSA-3mv5-343c-w2qg Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMut

LOW Published 2023-12-15 Modified 2024-02-12 Official page ↗
Ecosystem
crates.io
Packages
zerocopy
Severity
Low
Reviewed
2023-12-15

Affected packages

• crates.io zerocopy: >= 0.2.2, < 0.2.9 → fixed in 0.2.9 • crates.io zerocopy: >= 0.3.0, < 0.3.2 → fixed in 0.3.2 • crates.io zerocopy: >= 0.4.0, < 0.4.1 → fixed in 0.4.1 • crates.io zerocopy: >= 0.5.0, < 0.5.2 → fixed in 0.5.2 • crates.io zerocopy: >= 0.6.0, < 0.6.6 → fixed in 0.6.6 • crates.io zerocopy: >= 0.7.0, < 0.7.31 → fixed in 0.7.31

Description

*This advisory is also published as RUSTSEC-2023-0074.* The `Ref` methods `into_ref`, `into_mut`, `into_slice`, and `into_slice_mut` are unsound and may allow safe code to exhibit undefined behavior when used with `Ref` where `B` is `cell::Ref` or `cell::RefMut`. Note that these methods remain sound when used with `B` types other than `cell::Ref` or `cell::RefMut`. See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis. The current plan is to yank the affected versions soon. See https://github.com/google/zerocopy/issues/679 for more detail.

References