Listen to this Post
How the mentioned CVE works:
The vulnerability stems from a panic occurring during sequential element deallocation in thin_vec’s `IntoIter::drop` and ThinVec::clear. Both functions use `ptr::drop_in_place` to free elements, then call `set_len(0)` to reset length. If a panic happens inside an element’s `Drop` (e.g., a PanicBomb), `set_len(0)` is never reached. During stack unwinding, the container is dropped again because its length still indicates allocated memory. This causes already-freed memory to be re‑freed (Double Free) or accessed (Use‑After‑Free). The standard library prevents this with a `DropGuard` RAII pattern, but `thin_vec` lacks it. Miri and ASAN confirm undefined behavior. Attackers can combine this with `Box
dailycve form:
Platform: Rust thin_vec crate
Version: 0.2.14
Vulnerability: Double Free UAF
Severity: Critical
date: 2026-04-15
Prediction: Expected patch May
What Undercode Say:
Check vulnerable version cargo tree | grep thin_vec Reproduce with Miri (requires nightly) rustup +nightly component add miri cargo +nightly miri run Reproduce with AddressSanitizer RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release Verify fix by upgrading to patched version (e.g., >=0.2.15) cargo update -p thin_vec
How Exploit:
- Craft elements whose `Drop` panics (e.g., `PanicBomb` with a “panic” string).
- Place them in a `ThinVec` so the panic occurs during `into_iter().drop` or
clear(). - Trigger the panic – `set_len(0)` is skipped, container length unchanged.
- On unwinding, container’s `Drop` runs again, double‑freeing already freed heap objects.
- For ACE: allocate `Box
` adjacent to freed fat pointers; spray fake vtables to redirect `drop` calls.
Protection from this CVE
- Upgrade `thin_vec` to a patched version (once available) implementing
DropGuard. - Avoid panics in `Drop` implementations of elements stored in
ThinVec. - Use `std::vec::Vec` instead of `thin_vec` where panic safety is required.
- Apply the RAII guard pattern manually: set length to zero before
drop_in_place. - Compile with `panic=abort` to prevent unwinding (mitigates but not a fix).
Impact:
Memory corruption (Double Free / Use‑After‑Free) leading to denial of service, information disclosure, or arbitrary code execution via vtable hijacking. All safe Rust code using `thin_vec` with panic‑prone element types is affected. Confirmed with Miri and ASAN.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
