Undefined Behavior in bounded Crossbeam channel

Root

Cause

The vulnerability resides in the bounded channel implementation of crossbeam-channel prior to version 0.4.4. The code incorrectly assumed that Vec::from_iter allocates exactly the number of elements as capacity. In reality, Vec::from_iter may allocate extra memory. The bounded channel's destructor reconstructs a Vec from a raw pointer based on this false assumption, leading to deallocation with an incorrect capacity [1][3].

Exploitation

This is a memory safety issue that manifests during destruction of the bounded channel. An attacker would need to be able to trigger the drop of a bounded channel whose internal buffer was allocated with a size different from the expected capacity. No special network position or authentication is required if the vulnerable code path is exercised in a user-controlled application [1][2].

Impact

When Vec::from_iter allocates extra capacity, the destructor frees a mismatched memory region, which is undefined behavior. This unsoundness can lead to memory corruption, potentially exploitable for arbitrary code execution or information disclosure. Real-world impact may include deadlocks in allocators such as jemalloc, as reported in downstream projects [2].

Mitigation

The issue has been fixed in crossbeam-channel version 0.4.4 by using Box<[T]> instead of Vec for the buffer, guaranteeing exact capacity [2][3]. All users should upgrade to 0.4.4 or later.