{"id":"CVE-2022-23639","aliases":["GHSA-qc84-gqf4-9926","RUSTSEC-2022-0041"],"url":"https://o3.security/vulnerability/CVE-2022-23639","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils","details":"### Impact\n\nThe affected versions of this crate incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. \n\nHowever, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`.\n\nThis can cause the following problems:\n\n- Unaligned memory accesses\n- Data race\n\nCrates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue.\n\n32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue.\n32-bit targets with `Atomic{I,U}64` and `{i,u}64` have the same alignment are also not affected by this issue.\n\nThe following is a complete list of the builtin targets that may be affected. (last update: nightly-2022-02-11)\n\n- armv7-apple-ios (tier 3)\n- armv7s-apple-ios (tier 3)\n- i386-apple-ios (tier 3)\n- i586-unknown-linux-gnu\n- i586-unknown-linux-musl\n- i686-apple-darwin (tier 3)\n- i686-linux-android\n- i686-unknown-freebsd\n- i686-unknown-haiku (tier 3)\n- i686-unknown-linux-gnu\n- i686-unknown-linux-musl\n- i686-unknown-netbsd (tier 3)\n- i686-unknown-openbsd (tier 3)\n- i686-wrs-vxworks (tier 3)\n\n([script to get list](https://gist.github.com/taiki-e/3c7891e8c5f5e0cbcb44d7396aabfe10))\n\n### Patches\n\nThis has been fixed in crossbeam-utils 0.8.7.\n\nAffected 0.8.x releases have been yanked.\n\n### References\n\nhttps://github.com/crossbeam-rs/crossbeam/pull/781 \n\n### License\n\nThis advisory is in the public domain.","published":"2022-02-15T18:20:10Z","modified":"2026-08-12T03:51:40.959113206Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"crates.io","name":"crossbeam-utils","fixedVersion":"0.8.7"}],"fix":{"url":"https://github.com/crossbeam-rs/crossbeam/pull/781","label":"crossbeam-rs/crossbeam#781"},"references":[{"type":"WEB","url":"https://github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23639.json"},{"type":"ADVISORY","url":"https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23639"},{"type":"FIX","url":"https://github.com/crossbeam-rs/crossbeam/pull/781"},{"type":"PACKAGE","url":"https://github.com/crossbeam-rs/crossbeam"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2022-0041.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.959113206Z"}}