Publish GHSA-rvr2-r3pv-5m4p

Author: advisory-database[bot]

advisories/github-reviewed/2026/01/GHSA-rvr2-r3pv-5m4p/GHSA-rvr2-r3pv-5m4p.json

@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rvr2-r3pv-5m4p",
+  "modified": "2026-01-27T00:59:05Z",
+  "published": "2026-01-27T00:59:04Z",
+  "aliases": [],
+  "summary": "oneshot has potential Use After Free when used asynchronously",
+  "details": "There is a race condition that can lead to a use-after-free if a `oneshot::Receiver` is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.\n\nWhen the `Receiver` is polled (`Future::poll`) it writes a waker to the channel and sets it to the `RECEIVING` state. If the `Receiver` was then dropped (instead of polled to completion), the `Drop` implementation on `Receiver` unconditionally swapped the channel state to `DISCONNECTED` and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the `DISCONNECTED` state could be observed by the `Sender`, which would lead to it deallocating the channel heap memory. If the `Sender` manage to free the channel before the `Receiver` managed to proceed to dropping the waker, then the `Receiver` would read from the freed channel memory (Use After Free).\n\nThe fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of `oneshot` version `0.1.12`.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "oneshot"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.1.12"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/faern/oneshot/issues/73"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rustsec/advisory-db/pull/2600"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/faern/oneshot/commit/d1a1506010bc48962634807d0dcca682af4f50ba"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/faern/oneshot"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0005.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-362",
+      "CWE-416"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-01-27T00:59:04Z",
+    "nvd_published_at": null
+  }
+}