
We found results for “”
WS-2023-0422
Date: August 19, 2025
Insufficient covariance check makes self_cell unsound: All public versions prior to 1.02 used an insufficient check to ensure that users correctly marked the dependent type as either covariant or not_covariant. This allowed users to mark a dependent as covariant even though its type was not covariant but invariant, for certain invariant types involving trait object lifetimes. One example for such a dependent type is type Dependent<'a> = RefCell<Box<dyn fmt::Display + 'a>>. Such a type allowed unsound usage in purely safe user code that leads to undefined behavior. The patched versions now produce a compile time error if such a type is marked as covariant.
Language: RUST
Severity Score
Related Resources (5)
Severity Score
Weakness Type (CWE)
Insufficient Verification of Data Authenticity
CWE-345CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | NONE |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | NONE |
Integrity (I): | HIGH |
Availability (A): | NONE |