AIKIDO-2026-995212

rtrb is vulnerable to Double Free

Double Free Pre-CVE Published 2 days ago

Low Risk

This Affects:

rtrb

0.1.0 - 0.3.4

Fixed in 0.3.5

Are you affected? Scan for Free

TL;DR

ReadChunk::commit and ReadChunk::commit_all drop committed elements before advancing the consumer head. If an element's Drop implementation panics during that loop, the head is never updated, so the ring buffer still treats those slots as live. When the RingBuffer is later dropped, or a later read_chunk() / commit() touches the same slots, the already-dropped elements are dropped again, causing a double free or use-after-free that is reachable from safe Rust. The fix advances the consumer head so slots are not treated as live if a destructor panics.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you call ReadChunk::commit or ReadChunk::commit_all with elements whose Drop implementation can panic, then continue to use or drop the RingBuffer after catching the unwind. Types that never panic in Drop do not trigger this issue.

Background info

rtrb is vulnerable to Double Free in versions 0.1.0 - 0.3.4.

How to fix this

Upgrade the rtrb library to the patch version. Users on the 0.3.x line should prefer 0.3.5; 0.4.0 also contains the fix but changes is_abandoned() behavior.

Low Risk