Skip to content

TiKV linter failed due to RUSTSEC-2025-{0022,0023,0024} #18398

@hbisheng

Description

@hbisheng

PRs can't be merged due to the following linter issues:

error[vulnerability]: Use-After-Free in `Md::fetch` and `Cipher::fetch`
    ┌─ /home/jenkins/tikv-src/Cargo.lock:351:1
    │
351 │ openssl 0.10.57 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2025-0022
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0022
    ├ When a `Some(...)` value was passed to the `properties` argument of either of these functions, a use-after-free would result.


error[unsound]: Broadcast channel calls clone in parallel, but does not require `Sync`
    ┌─ /home/jenkins/tikv-src/Cargo.lock:556:1
    │
556 │ tokio 1.41.1 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2025-0023
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0023
    ├ The broadcast channel internally calls `clone` on the stored value when
      receiving it, and only requires `T:Send`. This means that using the broadcast
      channel with values that are `Send` but not `Sync` can trigger unsoundness if
      the `clone` implementation makes use of the value being `!Sync`.


error[vulnerability]: crossbeam-channel: double free on Drop
    ┌─ /home/jenkins/tikv-src/Cargo.lock:120:1
    │
120 │ crossbeam-channel 0.5.13 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2025-0024
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0024
    ├ The internal `Channel` type's `Drop` method has a race
      which could, in some circumstances, lead to a double-free.
      This could result in memory corruption.

Metadata

Metadata

Assignees

No one assigned

    Labels

    affects-8.1This bug affects the 8.1.x(LTS) versions.affects-8.5This bug affects the 8.5.x(LTS) versions.severity/minortype/bugThe issue is confirmed as a bug.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions