GHSA-xphw-cqx3-667j

Описание

Summary

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin_vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code — no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

Both vulnerabilities share the same root cause. When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 — IntoIter::drop

Location: thin-vec/src/lib.rs L.2308~2314

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

Vulnerability 2 — ThinVec::clear

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

Recommended Fix

Both vulnerabilities can be resolved with the same pattern:

• DropGuard pattern: Insert an RAII guard before drop_in_place to guarantee set_len(0) is called regardless of panic
• Pre-zeroing approach: Set the length to 0 before calling drop_in_place

PoC

Requirements: Rust nightly toolchain, thin-vec = "0.2.14"

PoC-1: IntoIter::drop

Miri output:

ASAN output:

PoC-2: ThinVec::clear

Impact

Vulnerability classification:

• CWE-415: Double Free
• CWE-416: Use-After-Free

Affected code: All code satisfying the following conditions simultaneously:

1. ThinVec stores heap-owning types (String, Vec, Box, etc.)
2. (Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
3. The Drop implementation of a remaining element triggers a panic

Additionally, when combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.