Executive brief
The ringbuf Rust library contains a memory safety defect in the Consumer::skip() and Consumer::clear() methods. When an element's destructor panics during cleanup, the ring buffer's read position is not updated, leading to the same memory being freed twice when the ring buffer itself is destroyed. This can be triggered from safe Rust code and results in memory corruption.
Technical details
The vulnerability is a double-free and use-after-free (CWE-415/416) in ringbuf's Consumer::skip() and Consumer::clear() functions. These methods drop elements in place but only update the read index afterward; if a Drop implementation panics mid-loop, the read index update is skipped, leaving it pointing to already-freed memory. When the ring buffer destructor runs, it re-visits and frees the same slots a second time. Both functions are affected because Consumer::clear() delegates to Consumer::skip(self.len()), and the issue is reachable from safe Rust.
Affected products
- agerasev ringbuf before 0.5.2
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in version 0.5.2