New release of crossbeam-epoch

[Aaron1011]

The current unreleased version of crossbeam-epoch bumps its scopeguard dependency for 1.0. This will be a big help in reducing duplicate scopeguard dependencies - since it's now at 1.0, Cargo will apply the normal Semver rules when picking dependencies (i.e. treating minor versions as compatible).

It would be very useful to get a new point release of crossbeam-epoch to make this transitive dependency change available.

[kingishb]

Hi! This is also necessary -- I think-- to get a new version of memoffset, which was upgraded in #402 but did not have a corresponding hotfix change to the parent project. My local version of crossbeam 0.7.1 , for example, doesn't update the dependency, which the cargo audit tool flags as a having security vulnerability:

error: Vulnerable crates found!

ID:      RUSTSEC-2019-0011
Crate:   memoffset
Version: 0.2.1
Date:    2019-07-16
URL:     https://github.com/Gilnaa/memoffset/issues/9#issuecomment-505461490
Title:   Flaw in offset_of and span_of causes SIGILL, potential memory unsafety
Solution: upgrade to: >= 0.5.0

error: 1 vulnerability found!

[kingishb]

Oh whoops, I see this is already acknowledged in the linked discussion. Sorry to be repetitive -- thanks!

[RalfJung]

@kingishb note that the advisory is only for versions 0.3 and 0.4. I do not know why it is even shown to you with version 0.2.1.

Version 0.2.1 is unsound but not known to cause any concrete problems.

[kingishb]

Hey just to follow up in both threads I wrote up what I see here: rustsec/advisory-db#124 (comment)

[rfk]

Version 0.2.1 is unsound but not known to cause any concrete problems.

Just an FYI for anyone who comes across this issue, the advisory has since been updated to include all versions prior to 0.5, so 0.2.1 is indeed affected and will be reported y cargo audit. Ref rustsec/advisory-db#129

[RalfJung]

Right, it was found out that the lack of protection against deref coercions could (if the deref coercion panics) lead to drop on uninitialized memory.

However, if crossbeam does not actually call offset_of on a field involving a deref coercion, there is no issue in crossbeam.