diff --git a/EXAMPLE_ADVISORY.md b/EXAMPLE_ADVISORY.md index d3b71db45..61229d208 100644 --- a/EXAMPLE_ADVISORY.md +++ b/EXAMPLE_ADVISORY.md @@ -6,8 +6,11 @@ date = "2020-01-31" url = "https://example.com" # Valid categories: "code-execution", "crypto-failure", "denial-of-service", "file-disclosure" # "format-injection", "memory-corruption", "memory-exposure", "privilege-escalation" +# They are described at https://github.com/rustsec/rustsec/blob/main/rustsec/src/advisory/category.rs categories = ["code-execution", "privilege-escalation"] keywords = ["example", "freeform", "keywords"] +# Valid informational: notice, unmaintained, unsound +informational = "unsound" #aliases = ["CVE-YYYY-NNNN"] #cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" diff --git a/crates/lockfree/RUSTSEC-0000-0000.md b/crates/lockfree/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..68d1b2f46 --- /dev/null +++ b/crates/lockfree/RUSTSEC-0000-0000.md @@ -0,0 +1,25 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "lockfree" +date = "2025-11-17" +url = "https://gitlab.com/bzim/lockfree/-/issues/4" +categories = ["memory-corruption"] +keywords = ["memory-safety", "std::mem::uninitialized"] +informational = "unsound" + +[versions] +patched = [] +unaffected = ["<= 0.4.0"] +``` + +# lockfree crate is unsound and unmaintained + +Affected versions of this crate called `mem::uninitialized()` to construct `Removable`. +This is unsound. + +In addition, the `lockfree` crate is no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. + +## Recommended alternatives + +- [`lock_freedom`](https://crates.io/crates/lock_freedom) \ No newline at end of file