Skip to content
OpenAdvisories
High · 8.1 CVE-2022-23639 EUVD-2022-1149GHSA-qc84-gqf4-9926RUSTSEC-2022-0041

Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils

Published Feb 15, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Description

crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.

Affected products

VendorProductAffectedFixed
crossbeam-rs crossbeam < 0.8.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-crossbeam-utils 0.8.8-1 —
Debian 13 rust-crossbeam-utils 0.8.8-1 —
Debian 12 rust-crossbeam-utils 0.8.8-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 thunderbird No fix yet —
Ubuntu 26.04 LTS thunderbird No fix yet —
Ubuntu 25.10 thunderbird No fix yet —
Ubuntu 24.04 LTS thunderbird No fix yet —
Ubuntu 22.04 LTS firefox 1:1snap1-0ubuntu1 —
Ubuntu 22.04 LTS mozjs78 +3 No fix yet —
Ubuntu 22.04 LTS rustc 1.58.1+dfsg1~ubuntu1-0ubuntu1 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS mozjs52 +2 No fix yet —
Ubuntu 20.04 LTS rustc 1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2 —
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —
Ubuntu Pro 16.04 LTS cargo +1 No fix yet —
Ubuntu Pro 14.04 LTS rustc No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 librsvg2 2.58.1-1 —
Azure Linux 3 ripgrep No fix yet —
Azure Linux 3 rust crossbeam_utils-0.8.7 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io crossbeam-utils < 0.8.7 0.8.7 GHSA-qc84-gqf4-9926
crates.io crossbeam-utils >= 0.0.0-0, < 0.8.7 0.8.7 RUSTSEC-2022-0041

References