CVE-2022-23639None▾ SunlitUnsoundness of AtomicCell<*64> arithmetics on 32-bit targets that support Atomic*64
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.2%
Affected versions of this crate incorrectly assumed that the alignment of {i,u}64 was always the same as Atomic{I,U}64.
However, the alignment of {i,u}64 on a 32-bit target can be smaller than Atomic{I,U}64.
This can cause the following problems:
Crates using fetch_* methods with AtomicCell<{i,u}64> are affected by this issue.
32-bit targets without Atomic{I,U}64 and 64-bit targets are not affected by this issue.
32-bit targets with Atomic{I,U}64 and {i,u}64 have the same alignment are also not affected by this issue.
The following is a complete list of the builtin targets that may be affected. (last update: nightly-2022-02-11)
This has been fixed in crossbeam-utils 0.8.7.
Affected 0.8.x releases have been yanked.
Thanks to @taiki-e.
crossbeam-utils >= 0.0.0-0, < 0.8.7Upgrade to a patched release:
crossbeam-utils 0.8.7