A malicious coder can get unsound access to TCell or TLCell memory
High severity
GitHub Reviewed
Published
Jun 17, 2022
to the GitHub Advisory Database
•
Updated Jan 12, 2023
Description
Published to the GitHub Advisory Database
Jun 17, 2022
Reviewed
Jun 17, 2022
Last updated
Jan 12, 2023
This is impossible to do by accident, but by carefully constructing
marker types to be covariant, a malicious coder can cheat the
singleton check in
TCellOwner
andTLCellOwner
, giving unsoundaccess to cell memory. This could take the form of getting two
mutable references to the same memory, or a mutable reference and an
immutable reference.
The fix is for the crate to internally force the marker type to be
invariant. This blocks the conversion between covariant types which
Rust normally allows.
References