N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rvr2-r3pv-5m4p

GHSA-rvr2-r3pv-5m4p: oneshot has potential Use After Free when used asynchronously

There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar.

When the Receiver is polled (Future::poll) it writes a waker to the channel and sets it to the RECEIVING state. If the Receiver was then dropped (instead of polled to completion), the Drop implementation on Receiver unconditionally swapped the channel state to DISCONNECTED and only after doing so it read back its waker from the heap allocation and dropped it. The problem is that the DISCONNECTED state could be observed by the Sender, which would lead to it deallocating the channel heap memory. If the Sender manage to free the channel before the Receiver managed to proceed to dropping the waker, then the Receiver would read from the freed channel memory (Use After Free).

The fix was submitted in https://github.com/faern/oneshot/pull/74 and published as part of oneshot version 0.1.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rvr2-r3pv-5m4p

GHSA-rvr2-r3pv-5m4p:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
oneshot	rust	< 0.1.12	0.1.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a use-after-free caused by a race condition in the oneshot crate's channel implementation. The issue occurs when an asynchronous oneshot::Receiver is polled but then dropped before the operation completes.

When Future::poll is called on a Receiver, it places the channel into a RECEIVING state and stores a Waker in the channel's shared memory.
If the Receiver future is then dropped (e.g., due to a timeout), its drop implementation is executed.
The vulnerable version of Receiver::drop would first unconditionally change the channel's state to DISCONNECTED.
This DISCONNECTED state signals to the Sender that it can safely deallocate the shared channel memory.
After setting the state, the Receiver::drop implementation would then check the previous state. If it was RECEIVING, it would proceed to access the shared channel memory to retrieve and drop the Waker.
A race condition exists here: if the Sender thread processes the DISCONNECTED state and deallocates the channel memory before the Receiver's drop logic finishes with it, the Receiver will attempt to read from freed memory, causing a use-after-free.

The fix, seen in commit d1a1506010bc48962634807d0dcca682af4f50ba, resolves this by changing the logic in Receiver::drop. Before marking the channel as DISCONNECTED, it now checks if the state is RECEIVING. If so, it atomically swaps it to EMPTY, ensuring it has exclusive access to the Waker before the Sender is signaled to deallocate the memory.

The primary vulnerable function is oneshot::Receiver::drop, as it contains the flawed logic that leads to the use-after-free.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.