UBUNTU-CVE-2022-23639

    Dashboard / Vulnerabilities / UBUNTU-CVE-2022-23639

    UBUNTU-CVE-2022-23639

    Published: 15 Feb 2022Last Modified: 17 Oct 2026
    Upstream:
    CVE-2022-23639

    Summary:

    Details: crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.

    References: https://ubuntu.com/security/CVE-2022-23639, https://github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7, https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926, https://github.com/crossbeam-rs/crossbeam/pull/781, https://www.cve.org/CVERecord?id=CVE-2022-23639

    Affected packages

    Package

    Name: rustc

    Purl: pkg:deb/ubuntu/rustc?arch=source&distro=trusty%2Fesm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.15.1+dfsg0-1~exp1ubuntu2~14.04.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2022-23639 | CVE-DB