-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lru | rust | >= 0.9.0, < 0.16.3 | 0.16.3 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the IterMut iterator of the lru crate. The next and next_back methods were implemented in a way that created a temporary mutable (exclusive) reference to an item's key while iterating. According to Rust's borrowing rules (specifically Stacked Borrows), creating an exclusive reference invalidates any other existing shared references to the same data. The internal HashMap used by the LRU cache held such a shared reference. When IterMut::next or IterMut::next_back was called, this shared reference was invalidated, but the HashMap was unaware of this. Subsequent operations on the cache could then use this invalid pointer, leading to undefined behavior. The fix, as seen in commit b9bca3492d75139097df3b018b6abdf5825ee868, was to change the creation of the reference from a mutable &mut to a shared &, thus avoiding the violation of the borrowing rules.
IterMut::nextsrc/lib.rs
IterMut::next_backsrc/lib.rs