CVE-2022-23639

Katalog CVE

CVSS 8.1 · High EPSS 1,2%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada crossbeam project crossbeam. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.

Rincian

Terbit di NVD

15 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/crossbeam-rs/crossbeam/pull/781 issue tracking · patch · advisory pihak ketiga
• https://github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7 patch · advisory pihak ketiga
• https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926 exploit · advisory pihak ketiga