2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48751

CVE-2025-48751: process_lock has a Potential Unsound issue in unlock

The process_lock crate 0.1.0 for Rust allows data races in unlock.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48751

CVE-2025-48751:

2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
process_lock	rust	<= 0.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-48751 and GHSA-6v24-6wgf-8vj6, is a data race condition in the process_lock crate, specifically within its unlock functionality. The GitHub issue #1 for the tickbh/ProcessLock repository clearly pinpoints the unlock method in ProcessLock/src/lib.rs (lines 51-54 in commit 0c53991) as the source of the unsoundness.

The core issue is that the ProcessLock::unlock method is public and is not declared as unsafe. In Rust, unsafe is used to indicate operations that can violate memory safety if not used correctly. Lock APIs often mark manual unlock functions as unsafe because calling them at an inappropriate time (e.g., while a lock guard object still exists and expects to perform the unlock on drop) can break invariants and lead to race conditions or double unlocks.

The provided PoC in the GitHub issue demonstrates how a user can call this unlock method directly, potentially leading to a situation where the lock is released prematurely. If another part of the program (or another thread/process) then acquires the lock, and the original LockGuard (which automatically unlocks when it goes out of scope) later attempts to unlock it again, a data race or incorrect lock state can occur.

The commit 0c539910c48e980b2bf97b1cf567957b0e872b1a contains the definition of this public, non-unsafe unlock function, making it the version of code where the vulnerability exists. The advisory confirms that versions <= 0.1.0 are affected, and this commit is part of that version. Therefore, process_lock::ProcessLock::unlock is the key function that, when called under specific race conditions facilitated by its unsafe-but-not-marked-unsafe nature, triggers the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.