Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ GHSA-9c9f-7x9p-4wqp — qcell

🟠 CVSS 8.0 — High ✅ No Known Exploit OSV
8.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

A malicious coder can get unsound access to TCell or TLCell memory

This is impossible to do by accident, but by carefully constructing

marker types to be covariant, a malicious coder can cheat the

singleton check in TCellOwner and TLCellOwner, giving unsound

access to cell memory. This could take the form of getting two

mutable references to the same memory, or a mutable reference and an

immutable reference.

The fix is for the crate to internally force the marker type to be

invariant. This blocks the conversion between covariant types which

Rust normally allows.

Affected software

GHSA-9c9f-7x9p-4wqp is recorded against 1 package.

  • qcell

Timeline and source

Published on 17 June 2022 and last revised on 8 November 2023. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Package)
rustsec.org (Web)

Details

Severity HIGH
CVSS Score 8.0
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2022-06-17
Updated 2026-08-20
Modified 2023-11-08
Fix URL N/A

Affected Packages

Software From version Fixed in
qcell — —

Similar Threats

Site Security Check

Is qcell part of your stack?

GHSA-9c9f-7x9p-4wqp is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.