GHSA-mc9m-6fm9-pghc: Race Condition
A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent getenv operation that has already loaded a pointer to the old buffer may subsequently index into freed memory and retrieve a stale or corrupted Pin<Box<Environment>>.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/kcl-libto a version that resolves this vulnerability.Fixed in 0.2.153 - Upgrade
Upgrade
pip/zoo-kclto a version that resolves this vulnerability.Fixed in 0.3.153
Event History
Frequently Asked Questions
Which software packages should be reviewed for exposure?
Review deployments using rust/kcl-lib or pip/zoo-kcl. No affected or fixed version ranges are provided.
What runtime condition is required for the issue to occur?
The condition requires concurrent environment access: a get_env operation must use a previously loaded buffer pointer while another operation causes the environment Vec to reallocate. This can cause the read to use freed memory and return a stale or corrupted environment object.