RUSTSEC-2026-0291

Vulnerability from osv_rustsec – Published: 2026-09-09 12:00 – Updated: 2026-09-21 09:00 – Source website
VLAI
Summary
Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics
Details

OwnedAlloc::drop_in_place destroys the contained value by hand, then commits the ownership transfer with mem::forget(self) — which lives inside into_raw and so runs only after the destruction. T::drop is user code and may panic. If it does, the forget is skipped and the still-live OwnedAlloc unwinds, whose destructor drops the same T a second time and then deallocates. For a T that owns an allocation, the same block is freed twice — a double free (CWE-415). That destructor also reads the already-destroyed value through Layout::for_value before deallocating, a use-after-free (CWE-416).

MaybeUninitAlloc::drop_in_place delegates to the same function, so both public entry points are affected. Storing a value whose Drop can panic and calling either is enough — no unsafe on the caller's side.

Fix

No fixed release is available. The crate has had no release since 2018 and the maintainer has not responded to the report, nor to the one on lockfree, which is published from the same account. forget_inner leaks the value instead of destroying it, which is safe.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-corruption"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "owned_alloc::MaybeUninitAlloc::drop_in_place",
            "owned_alloc::OwnedAlloc::drop_in_place"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "owned-alloc",
        "purl": "pkg:cargo/owned-alloc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "`OwnedAlloc::drop_in_place` destroys the contained value by hand, then commits\nthe ownership transfer with `mem::forget(self)` \u2014 which lives inside `into_raw`\nand so runs only after the destruction. `T::drop` is user code and may panic. If\nit does, the forget is skipped and the still-live `OwnedAlloc` unwinds, whose\ndestructor drops the same `T` a second time and then deallocates. For a `T` that\nowns an allocation, the same block is freed twice \u2014 a double free (CWE-415).\nThat destructor also reads the already-destroyed value through\n`Layout::for_value` before deallocating, a use-after-free (CWE-416).\n\n`MaybeUninitAlloc::drop_in_place` delegates to the same function, so both public\nentry points are affected. Storing a value whose `Drop` can panic and calling\neither is enough \u2014 no `unsafe` on the caller\u0027s side.\n\n## Fix\n\nNo fixed release is available. The crate has had no release since 2018 and the\nmaintainer has not responded to the report, nor to the one on `lockfree`, which\nis published from the same account. `forget_inner` leaks the value instead of\ndestroying it, which is safe.",
  "id": "RUSTSEC-2026-0291",
  "modified": "2026-09-21T09:00:40Z",
  "published": "2026-09-09T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/owned-alloc"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0291.html"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.com/bzim/owned-alloc/-/issues/1"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Double free in `OwnedAlloc::drop_in_place` when the contained value\u0027s `Drop` panics"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.