Bug 2366570 - CVE-2025-4574 ruby: crossbeam-channel Vulnerable to Double Free on Drop [fedora-42]
Summary: CVE-2025-4574 ruby: crossbeam-channel Vulnerable to Double Free on Drop [fedo...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: ruby
Version: 42
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Vít Ondruch
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["62aa5787-67fa-449e-acc0-a...
Depends On:
Blocks: CVE-2025-4574, GHSA-pg9f-39pc-qf8g
TreeView+ depends on / blocked
 
Reported: 2025-05-15 14:35 UTC by Michal Findra
Modified: 2025-05-16 09:29 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-05-16 09:29:15 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Michal Findra 2025-05-15 14:35:54 UTC
More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2358890

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Vít Ondruch 2025-05-15 18:03:07 UTC
~~~
$ grep -R crossbeam
gc/mmtk/Cargo.lock:name = "crossbeam"
gc/mmtk/Cargo.lock: "crossbeam-channel",
gc/mmtk/Cargo.lock: "crossbeam-deque",
gc/mmtk/Cargo.lock: "crossbeam-epoch",
gc/mmtk/Cargo.lock: "crossbeam-queue",
gc/mmtk/Cargo.lock: "crossbeam-utils",
gc/mmtk/Cargo.lock:name = "crossbeam-channel"
gc/mmtk/Cargo.lock: "crossbeam-utils",
gc/mmtk/Cargo.lock:name = "crossbeam-deque"
gc/mmtk/Cargo.lock: "crossbeam-epoch",
gc/mmtk/Cargo.lock: "crossbeam-utils",
gc/mmtk/Cargo.lock:name = "crossbeam-epoch"
gc/mmtk/Cargo.lock: "crossbeam-utils",
gc/mmtk/Cargo.lock:name = "crossbeam-queue"
gc/mmtk/Cargo.lock: "crossbeam-utils",
gc/mmtk/Cargo.lock:name = "crossbeam-utils"
gc/mmtk/Cargo.lock: "crossbeam",
gc/mmtk/Cargo.lock: "crossbeam-deque",
gc/mmtk/Cargo.lock: "crossbeam-utils",
~~~

I wonder if and how this could affect Ruby 🤔

Comment 2 Vít Ondruch 2025-05-16 09:29:15 UTC
So according to the README [1], the modular GC API would need to be first enabled by configuration option. Which is not, also confirmed in build.log [1] where there is `checking if building with modular GC support... no`. And if the modular GC was enabled, then the `mmtk` would need to be selected instead of the `default`, which obviously is not the case given the former. Therefore closing this as a NOTABUG.



[1]: https://github.com/ruby/ruby/blob/master/gc/README.md
[2]: https://kojipkgs.fedoraproject.org//packages/ruby/3.4.2/24.fc43/data/logs/x86_64/build.log


Note You need to log in before you can comment on or make changes to this bug.