GitHub Advisoryadvisory · crates.io

GHSA-3jc5-5hc5-33gj Data races in conquer-once

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-36208
Ecosystem
crates.io
Packages
conquer-once
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-662, CWE-787
Reviewed
2021-08-19

Affected packages

• crates.io conquer-once: < 0.3.2 → fixed in 0.3.2

Description

Affected versions of conquer-once implements Sync for its OnceCell type without restricting it to Sendable types. This allows non-Send but Sync types such as MutexGuard to be sent across threads leading to undefined behavior and memory corruption in concurrent programs. The issue was fixed by adding a Send constraint to OnceCell.

Related

Alias · CVE (1)

  • CVE-2020-36208 An issue was discovered in the conquer-once crate before 0.3.2 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-662 Improper Synchronization weakness
  • CWE-787 Out-of-bounds Write weakness

References