Add advisory for bump-scope: wrong documentation potentially leading to use-after-free

[bluurryy]

I'm the maintainer of the affected crate.

Affected crate(s)

• bump-scope (88,910 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• GHSA-xhx6-q96x-pf9c
• bluurryy/bump-scope@db9da19

Severity

Soundness issue in safety invariants of BumpAllocatorCore trait potentially leading to use-after-free bugs.

This does not affect safe code of the library. It only affects niche, unlikely to be useful or used, safety invariants.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

This does not affect safe code of the library. It only affects niche, unlikely to be useful or used, safety invariants.

If so, I don't think we need an advisory for it.

[bluurryy]

I do believe it is very unlikely that someone encounters that bug. Though I was thinking that for a soundness bug such as this it would be better safe than sorry, given that if someone was bitten by that bug it could hurt a lot.

I think an informational = "unsound" advisory is warranted. The description of informational = "unsound" in the MAINTAINERS_GUIDE.md fits this bug well:

informational = "unsound" is used for soundness issues that can only be triggered by a programmer (as opposed to e.g. a malicious input), and/or require very contrived code to trigger. They will be surfaced as warnings instead of hard errors by cargo audit.

[djc]

Please have a look at

• Discussion: signal/noise ratio too low? #2572

[bluurryy]

I've read through it and do think that this advisory would have a very low signal to noise ratio. In that sense I'd no longer like to add this advisory.

Thanks for the review!