Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
ArrayQueue in Rust can delete uninitialized memory when it panics
published 1 year ago
Summary
The ArrayQueue in Rust can delete memory that has not been properly initialized if it panics while adding a new item to the front of the queue. This can cause a crash when the queue is later cleaned up. Affected users should update to the fixed version of the library to avoid this issue.
What to do
- Update raviqqe array-queue to version 0.4.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | raviqqe | array-queue |
>= 0.3.0, < 0.4.0 Fix: upgrade to 0.4.0
|
Original advisory text
ArrayQueue's push_front is not panic-safe
The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.
Specifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.
The bug was fixed in commit `728fe1b`.
Specifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.
The bug was fixed in commit `728fe1b`.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-665Improper Initialization
Timeline
Published2 Sep 2025
Updated13 Mar 2026
First seen6 Mar 2026
Sources
GHSA-xqjr-wfx3-gmxv · GHSA
Track software like this
Free during beta