GHSA-9c9f-7x9p-4wqp
A malicious coder can get unsound access to TCell or TLCell memory
GHSA-9c9f-7x9p-4wqp is a vulnerability with no CVSS score yet in qcell, published January 24, 2022. No source lists public exploit code. Fixed in qcell 0.4.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.4.3qcell +1 more
Description
This is impossible to do by accident, but by carefully constructing
marker types to be covariant, a malicious coder can cheat the
singleton check in TCellOwner and TLCellOwner, giving unsound
access to cell memory. This could take the form of getting two
mutable references to the same memory, or a mutable reference and an
immutable reference.
The fix is for the crate to internally force the marker type to be invariant. This blocks the conversion between covariant types which Rust normally allows.
Affected packages
What each source reports
GitHub AdvisoriesNo score
A malicious coder can get unsound access to TCell or TLCell memory
This is impossible to do by accident, but by carefully constructing
marker types to be covariant, a malicious coder can cheat the
singleton check in TCellOwner and TLCellOwner, giving unsound
access to cell memory. This could take the form of getting two
mutable references to the same memory, or a mutable reference and an
immutable reference.
The fix is for the crate to internally force the marker type to be invariant. This blocks the conversion between covariant types which Rust normally allows.
- Record
GHSA-9c9f-7x9p-4wqp- Updated
- 2026-11-02
OSVNo score
A malicious coder can get unsound access to TCell or TLCell memory
This is impossible to do by accident, but by carefully constructing
marker types to be covariant, a malicious coder can cheat the
singleton check in TCellOwner and TLCellOwner, giving unsound
access to cell memory. This could take the form of getting two
mutable references to the same memory, or a mutable reference and an
immutable reference.
The fix is for the crate to internally force the marker type to be invariant. This blocks the conversion between covariant types which Rust normally allows.
- Record
GHSA-9c9f-7x9p-4wqp- Updated
- 2026-11-02
OSVRUSTSEC-2022-0007No score
A malicious coder can get unsound access to TCell or TLCell memory
This is impossible to do by accident, but by carefully constructing
marker types to be covariant, a malicious coder can cheat the
singleton check in TCellOwner and TLCellOwner, giving unsound
access to cell memory. This could take the form of getting two
mutable references to the same memory, or a mutable reference and an
immutable reference.
The fix is for the crate to internally force the marker type to be invariant. This blocks the conversion between covariant types which Rust normally allows.
- Record
RUSTSEC-2022-0007- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.