{"id":"GHSA-ghc8-5cgm-5rpf","aliases":["RUSTSEC-2023-0057"],"status":"published","title":"Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime","description":"Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`.\n\nIf the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these may not behave as documented. Panics are likely; UB is possible.\n\nThe flaw was corrected by enforcing that only code written within the `inventory` crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before `main`. Caller-provided code is restricted to running at compile time.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-09-10T12:00:00Z","modified":"2024-02-10T16:26:48Z","fixes":[{"ecosystem":"crates.io","package":"inventory","fixed_in":["0.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"inventory","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"inventory","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"inventory","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.0"}]}]}],"references":[{"url":"https://github.com/dtolnay/inventory/pull/43","tags":["web"]},{"url":"https://github.com/dtolnay/inventory/commit/b853350a3800e38d2cb9950355b80bc8b8d3959c","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0057.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ghc8-5cgm-5rpf"},{"url":"https://github.com/dtolnay/inventory","tags":["package"]},{"url":"https://crates.io/crates/inventory","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-ghc8-5cgm-5rpf","title":"Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime","description":"Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`.\n\nIf the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these may not behave as documented. Panics are likely; UB is possible.\n\nThe flaw was corrected by enforcing that only code written within the `inventory` crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before `main`. Caller-provided code is restricted to running at compile time.\n","status":"published","published":"2023-09-11T20:43:17Z","modified":"2023-09-11T20:44:11Z","updated_at":"2026-11-02T14:37:03.916765Z"}],"osv":[{"id":"GHSA-ghc8-5cgm-5rpf","title":"Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime","description":"Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`.\n\nIf the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these may not behave as documented. Panics are likely; UB is possible.\n\nThe flaw was corrected by enforcing that only code written within the `inventory` crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before `main`. Caller-provided code is restricted to running at compile time.\n","status":"published","published":"2023-09-11T20:43:17Z","modified":"2024-02-10T16:26:48.63337Z","updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"RUSTSEC-2023-0057","title":"Fails to prohibit standard library access prior to initialization of Rust standard library runtime","description":"Affected versions allow arbitrary caller-provided code to execute before the\nlifetime of `main`.\n\nIf the caller-provided code accesses particular pieces of the standard library\nthat require an initialized Rust runtime, such as `std::io` or `std::thread`,\nthese may not behave as documented. Panics are likely; UB is possible.\n\nThe flaw was corrected by enforcing that only code written within the\n`inventory` crate, which is guaranteed not to access runtime-dependent parts of\nthe standard library, runs before `main`. Caller-provided code is restricted to\nrunning at compile time.","status":"published","published":"2023-09-10T12:00:00Z","modified":"2024-02-10T16:26:48.63337Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}