-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| eyre | rust | >= 0.6.9, < 0.6.12 | 0.6.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from incorrect type parameter usage in unsafe casting operations within Report::downcast. The original implementation used ErrorImpl<ContextError<ManuallyDrop<E>, E>> instead of ErrorImpl<ContextError<ManuallyDrop<D>, E>> when downcasting to D, and similarly swapped types when downcasting to E. This type confusion causes the wrong drop implementations to be executed, as evidenced by the patch modifying these exact type parameters in the cast operations. The commit message explicitly states this was causing invalid drop implementations to be called, and the CWE-843 (Type Confusion) classification confirms the nature of the vulnerability.