N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j8cj-hw74-64jv

GHSA-j8cj-hw74-64jv: Hive has Double-free and Use After Free Vulnerabilities

Drop implementation for Hive did perform free, but so did Hive::close, which, at the end of the scope performed Drop, therefore triggering double-free.

Additionally, function Hive::from_handle was not marked as unsafe, making it, in combination with as_handle easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j8cj-hw74-64jv

GHSA-j8cj-hw74-64jv:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hivex	rust	= 0.2.0	0.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a double-free in the hivex crate. It occurs because both the Hive::close method and the Drop implementation for the Hive struct would free the same underlying raw handle. An explicit call to close() would free the handle, and then when the Hive object went out of scope, its drop() method would be invoked, freeing the same handle again.

This is exacerbated by the Hive::from_handle function, which was not marked as unsafe. This made it possible to create Hive objects from raw pointers in safe Rust code, potentially creating multiple Hive objects that point to the same handle. When these objects are dropped, a double-free or use-after-free would occur.

The patch addresses these issues by:

Modifying Hive::close to call std::mem::forget(self), which prevents the Drop implementation from running after close has already freed the handle.
Marking Hive::from_handle as unsafe, which forces callers to guarantee the safety of using the raw handle.

Therefore, the key functions involved in this vulnerability are Hive::close (which initiates the double-free sequence), Hive::from_handle (which allows for unsafe object creation), and Hive::drop (which performs the second free).

Vulnerable functions

hivex::Hive::close

hivex/src/lib.rs

The `close` function frees the underlying hive handle but did not prevent the `Drop` implementation from also running on the same object. This would cause the handle to be freed twice. The patch remediates this by calling `std::mem::forget(self)` after freeing the handle, which prevents the `drop` method from being called.

hivex::Hive::from_handle

hivex/src/lib.rs

This function was not marked as `unsafe`, allowing safe code to create a `Hive` object from a raw pointer. This could be used to create multiple owners for the same handle, leading to a double-free or use-after-free when the objects are dropped. The patch correctly marks the function as `unsafe`, requiring the caller to ensure the handle's validity.

hivex::Hive::drop

hivex/src/lib.rs

The `Drop` implementation for `Hive` unconditionally frees the associated handle. When `Hive::close` is called on an object, this `drop` implementation is also called when the object goes out of scope, leading to a double-free. This function would appear in a runtime profile as the second free operation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.