Executive brief
OneRingBuf is a Rust library used for managing ring buffers, which are data structures often used for efficient data streaming. A flaw in how the library handles memory allows a program to accidentally use memory after it has been freed. This could lead to unpredictable application behavior, data corruption, or system crashes.
Technical details
A use-after-free vulnerability exists in oneringbuf versions prior to 0.8.0. The library exposed the obsolete 'IntoRef::into_ref' method, which returns a 'DroppableRef' handle for heap-backed ring buffers. This handle uses a raw pointer and a manual reference counter ('alive_iters'). However, the 'Clone' implementation for 'DroppableRef' fails to increment this counter. Consequently, when one clone is dropped, it may trigger a 'Box::from_raw' call that frees the underlying allocation while other clones still exist. Subsequent access or dropping of the remaining clones results in a heap-use-after-free. The vulnerability is reachable via safe Rust code and was fixed in version 0.8.0 by removing the 'into_ref' method.
Affected products
- Skilvingr oneringbuf < 0.8.0
Timeline
- 2026-05-27: other: Reported
- 2026-06-01: advisory: RustSec advisory issued
- 2026-07-08: disclosed: GitHub Advisory published
- 2026-07-08: patched: Version 0.8.0 released