AIKIDO-2026-577724

string_cache is vulnerable to Use After Free

Use After Free Pre-CVE Published 3 days ago

Medium Risk

This Affects:

string_cache

0.1.0 - 0.10.0

Fixed in 0.11.0

Are you affected? Scan for Free

TL;DR

Cloning a dynamic Atom incremented the interned entry's atomic reference count with fetch_add and no overflow check. On 32-bit platforms, cloning an atom about 2.1 billion times wraps the count, freeing the intern-table entry while clones still exist and causing a use-after-free. The intern table also stored entries as Box<Entry> that were moved through the global linked list, invalidating raw pointers held by live Atoms under Stacked/Tree Borrows, and from_mutated_str created a mutable slice over uninitialized stack memory. Version 0.11.0 aborts on refcount overflow like Arc, stores entries as NonNull<Entry>, and copies through initialized memory only.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and intern dynamic (non-static) atoms. The reference-count overflow is primarily reachable on 32-bit targets after an extreme number of clones; the intern-table aliasing and uninitialized-memory issues apply on all architectures during ordinary dynamic-atom use.