{"id":"GHSA-9qxh-258v-666c","aliases":["RUSTSEC-2022-0040"],"status":"published","title":"owning_ref vulnerable to multiple soundness issues","description":"- `OwningRef::map_with_owner` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/77) and may result in a use-after-free.\n- `OwningRef::map` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/71) and may result in a use-after-free.\n- `OwningRefMut::as_owner` and `OwningRefMut::as_owner_mut` are [unsound](https://github.com/Kimundi/owning-ref-rs/issues/61) and may result in a use-after-free.\n- The crate [violates Rust's aliasing rules](https://github.com/Kimundi/owning-ref-rs/issues/49), which may cause miscompilations on recent compilers that emit the LLVM `noalias` attribute.\n\nNo patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-01-26T12:00:00Z","modified":"2023-11-08T04:18:04Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"owning_ref","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"owning_ref","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.4.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"owning_ref","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://github.com/noamtashma/owning-ref-unsoundness","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0040.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9qxh-258v-666c"},{"url":"https://github.com/Kimundi/owning-ref-rs","tags":["package"]},{"url":"https://crates.io/crates/owning_ref","tags":["package"]},{"url":"https://github.com/Kimundi/owning-ref-rs/issues/49","tags":["report"]},{"url":"https://github.com/Kimundi/owning-ref-rs/issues/61","tags":["report"]},{"url":"https://github.com/Kimundi/owning-ref-rs/issues/71","tags":["report"]},{"url":"https://github.com/Kimundi/owning-ref-rs/issues/77","tags":["report"]}],"sources":{"ghsa":[{"id":"GHSA-9qxh-258v-666c","title":"owning_ref vulnerable to multiple soundness issues","description":"- `OwningRef::map_with_owner` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/77) and may result in a use-after-free.\n- `OwningRef::map` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/71) and may result in a use-after-free.\n- `OwningRefMut::as_owner` and `OwningRefMut::as_owner_mut` are [unsound](https://github.com/Kimundi/owning-ref-rs/issues/61) and may result in a use-after-free.\n- The crate [violates Rust's aliasing rules](https://github.com/Kimundi/owning-ref-rs/issues/49), which may cause miscompilations on recent compilers that emit the LLVM `noalias` attribute.\n\nNo patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.\n","status":"published","published":"2022-08-10T17:26:00Z","modified":"2023-01-06T05:08:37Z","updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-9qxh-258v-666c","title":"owning_ref vulnerable to multiple soundness issues","description":"- `OwningRef::map_with_owner` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/77) and may result in a use-after-free.\n- `OwningRef::map` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/71) and may result in a use-after-free.\n- `OwningRefMut::as_owner` and `OwningRefMut::as_owner_mut` are [unsound](https://github.com/Kimundi/owning-ref-rs/issues/61) and may result in a use-after-free.\n- The crate [violates Rust's aliasing rules](https://github.com/Kimundi/owning-ref-rs/issues/49), which may cause miscompilations on recent compilers that emit the LLVM `noalias` attribute.\n\nNo patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.\n","status":"published","published":"2022-08-10T17:26:00Z","modified":"2023-11-08T04:18:04.747199Z","updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"RUSTSEC-2022-0040","title":"Multiple soundness issues in `owning_ref`","description":"- `OwningRef::map_with_owner` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/77) and may result in a use-after-free.\n- `OwningRef::map` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/71) and may result in a use-after-free.\n- `OwningRefMut::as_owner` and `OwningRefMut::as_owner_mut` are [unsound](https://github.com/Kimundi/owning-ref-rs/issues/61) and may result in a use-after-free.\n- The crate [violates Rust's aliasing rules](https://github.com/Kimundi/owning-ref-rs/issues/49), which may cause miscompilations on recent compilers that emit the LLVM `noalias` attribute.\n\n`safer_owning_ref` is a replacement crate which fixes these issues.\nNo patched versions of the original crate are available, and the maintainer is unresponsive.","status":"published","published":"2022-01-26T12:00:00Z","modified":"2023-11-08T04:18:04.747199Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}