-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| crossbeam | rust | < 0.3.0 | 0.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from incorrect use of Relaxed memory ordering in atomic operations within the MS Queue implementation. The original implementation (as shown in linked PR #98) used Ordering::Relaxed for both the store in push() and load in pop(), which doesn't provide the necessary happens-before relationships between producers and consumers. The fix changed these to Release/Acquire orderings respectively. The functions are clearly identified in the crossbeam issue #97 comments and subsequent fix in PR #98, with specific references to push/pop operations in ms_queue.rs. Memory corruption reports in production (as noted in the advisory) confirm the real-world impact of these weak orderings.