skiplist

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory (CWE-416). A safe impl Ord with the default comparator is enough to reach it.

The mutating traversals record a precursor at each level: the last node whose link points at a node comparing not-Less than the target. The splice code assumes every recorded precursor's link points at or past the final position. If a later comparison reports one of those nodes as Less, the walk steps past it and the assumption breaks. Removals such as take_first, take and remove then rewire the wrong link and free the target while its real predecessor still points at it. insert builds crossed links and wrong skip distances from the same precursors.

A comparator that is a pure function of its two arguments cannot trigger this, even if it is not transitive. The trigger is a stateful or non-deterministic implementation, for example one that reads a counter, a cache, a clock or a random source.

The flaw was corrected in 1.3.0. The mutating traversals track the link target of the lowest recorded precursor and panic with "comparator does not implement a total order" when a Less answer contradicts an earlier one. Every splice site also checks its precursors before the first write. Each detected contradiction panics before any link, value or length changes, so the collection stays valid and safe to drop.

Four code paths create a pointer whose permission is later revoked, then write through it. Miri reports each as undefined behaviour under both the Tree Borrows and Stacked Borrows aliasing models (CWE-758). All four are reachable from safe code with standard Ord types.

1. Splice back-pointer. split_off, split_off_index and append stored the first spliced node's prev pointer from a reference to the head, then wrote through that same reference, invalidating the stored pointer. A later pop_first or pop_front writes through it. This affects all four collections.
2. SkipMap::range_mut back pointer. With an Included or Excluded upper bound, the back pointer came from a shared reference. next_back hands out &mut V through it, and writing to that value is undefined behaviour.
3. IterMut::next_back reads a yielded node. In SkipList and SkipMap, next_back read the predecessor node even after the front end had yielded it as &mut. The read freezes the caller's reference, and the caller's next write through it is undefined behaviour. This affects iter_mut, values_mut and range_mut used from both ends.
4. Cursor list pointer. lower_bound_mut and upper_bound_mut on OrderedSkipList and SkipSet (cursor feature) took the cursor's list pointer, then searched through &self. A comparator with interior-mutable state, such as a Cell call counter, wrote to the list's memory through that shared borrow and invalidated the cursor's pointer. The comparator can be a fully consistent order. SkipMap cursors are not affected.

No miscompilation has been observed in an optimised build. A future compiler may still optimise on the violated aliasing assumptions.

The flaws were corrected in 1.3.0. Each fix derives the pointer used for mutation from the collection's long-lived allocation pointers, and each has a Miri regression test.

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero.

back(), back_mut(), last_key_value() and last() dereference tail through unsafe, so reading the container after the unwind is a use-after-free (CWE-416). Drop for SkipList calls Box::from_raw on self.head, which clear already destroyed, so dropping the container is a double free (CWE-415).

retain, retain_mut and dedup_by reach the same state through Node::filter_rebuild, which frees nodes and runs a user predicate before the caller commits tail and len. There the head links are left partially rewired, so traversal can also reach freed nodes.

Mitigation

Update to 1.1.1.