GitHub Advisoryadvisory · crates.io

GHSA-3hxh-7jxm-59x4 AtomicBucket<T> unconditionally implements Send/Sync

MEDIUM Published 2022-06-17 Modified 2022-06-17 Official page ↗
Ecosystem
crates.io
Packages
metrics-util
Severity
Moderate
Reviewed
2022-06-17

Affected packages

• crates.io metrics-util: < 0.7.0 → fixed in 0.7.0

Description

In the affected versions of the crate, `AtomicBucket` unconditionally implements `Send`/`Sync` traits. Therefore, users can create a data race to the inner `T: !Sync` by using the `AtomicBucket::data_with()` API. Such data races can potentially cause memory corruption or other undefined behavior. The flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct `Block` (which is a data type contained inside `AtomicBucket`).

References