GitHub Advisoryadvisory · crates.io

GHSA-368f-29c3-4f2r Data race in conqueue

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-36437
Ecosystem
crates.io
Packages
conqueue
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-10

Affected packages

• crates.io conqueue: < 0.4.0 → fixed in 0.4.0

Description

Affected versions of this crate unconditionally implemented `Send`/`Sync` for `QueueSender`, allowing to send non-Send `T` to other threads by invoking `(&QueueSender).send()`. This fails to prevent users from creating data races by sending types like `Rc` or `Arc>` to other threads, which can lead to memory corruption. The flaw was corrected in commit `1e462c3` by imposing `T: Send` to both `Send`/`Sync` impls for `QueueSender`/`QueueReceiver`.

Related

Alias · CVE (1)

  • CVE-2020-36437 An issue was discovered in the conqueue crate before 0.4.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References