Matt Keeter
@mattkeeter.com
3.7K followers 1.6K following 2.7K posts
✨ Weird CAD and graphics research ⚙️ Embedded software and Rust 🌎 Cambridge, MA 🏠 mattkeeter.com
✨ Weird CAD and graphics research ⚙️ Embedded software and Rust 🌎 Cambridge, MA 🏠 mattkeeter.com
![Screenshot of a Github issue with text
Spotted what might be an issue in Cargo.lock around line 4276.
Vulnerability: CVE-2026-6654 affects the thin-vec crate v0.2.15 (a Rust dependency locked in Cargo.lock). The flaw is a double-free / use-after-free in IntoIter::drop and ThinVec::clear: if ptr::drop_in_place panics while destroying elements (e.g., a panic in an element's Drop implementation), the vector's length is never set to zero. The remaining drop/clear logic then operates on already-destructed elements, freeing the same memory twice or reading freed memory. In code that relies on Rust's memory safety guarantees, this heap corruption can be escalated to denial of service or potentially arbitrary code execution, particularly if the panic path is attacker-influenceable. Severity: HIGH. Remediation: upgrade to thin-vec 0.2.16, which zeroes the length before unwinding through the drop loop, ensuring elements cannot be freed twice.
Something like this might fix it:
Recommended: update the locked dependency so the patched version is used.
# Run from the project root (regenerates Cargo.lock with the correct version and checksum):
cargo update -p thin-vec --precise 0.2.16
[diff elided for space]
Note: do not hand-edit the checksum; always let `cargo update` generate it to guarantee integrity.
For reference: rule CVE-2026-6654. Rated high.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:sgqw2zixdcjtjjhrm4bw64ny/bafkreifmcp3zjue7dt2ieov3r6aqdjbdacyzovy4vwsuxzy55rrxpfuz6a)
![Screenshot of a comment by mkeeter reading "[user has been blocked for this post]"](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:sgqw2zixdcjtjjhrm4bw64ny/bafkreif7joswziikyt7ka57pkzrewmcaqodhf3dzr6upotacuxqa2rr5qa)
![Screenshot of Rust code reading
use zerocopy::{IntoBytes, Unalign};
#[derive(Copy, Clone, IntoBytes)]
#[repr(u8)]
pub enum Opcode {
Add(Unalign<BinaryData>),
Sub(Unalign<BinaryData>),
Mul(Unalign<BinaryData>),
Div(Unalign<BinaryData>),
Atan(Unalign<BinaryData>),
Neg(Unalign<UnaryData>),
Square(Unalign<UnaryData>),
Sin(Unalign<UnaryData>),
Cos(Unalign<UnaryData>),
Tan(Unalign<UnaryData>),
}
#[derive(Copy, Clone, IntoBytes)]
#[repr(u8)]
pub enum BinaryData {
RegReg { out: u8, lhs: u8, rhs: u8, _pad: [u8; 3] },
RegImm { out: u8, lhs: u8, rhs: Unalign<f32> },
ImmReg { out: u8, rhs: u8, lhs: Unalign<f32> },
}
#[derive(Copy, Clone, IntoBytes)]
#[repr(u8)]
pub enum UnaryData {
Reg { out: u8, arg: u8, _pad: [u8; 4] },
}
fn main() {
assert_eq!(std::mem::size_of::<Opcode>(), 8);
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:sgqw2zixdcjtjjhrm4bw64ny/bafkreigechnlis7c7tqlxdd5kdpnf6ctfdcxsmcypkddqtt3qyrkxz66se)
![Screenshot of a webpage in Claude Beige reading
Current reading
[red circular icon] Closed](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:sgqw2zixdcjtjjhrm4bw64ny/bafkreialxat6fkn6a4wgyds7yasymmxxrawqfmywm44wcuxdfvcakyy2xu)
