GitHub Advisoryadvisory · crates.io

GHSA-686f-ch3r-xwmh Data races in unicycle

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36436
Ecosystem
crates.io
Packages
unicycle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-18

Affected packages

• crates.io unicycle: < 0.7.1 → fixed in 0.7.1

Description

Affected versions of this crate unconditionally implemented `Send` & `Sync` for types `PinSlab` & `Unordered`. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads. This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within `PinSlab` or `Unordered` and accessed concurrently from multiple threads. The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound `T: Send` to `Send` impls for `PinSlab` & `Unordered` and adding `T: Sync` to `Sync` impls for `PinSlab` & `Unordered`.

Related

Alias · CVE (1)

  • CVE-2020-36436 An issue was discovered in the unicycle crate before 0.7.1 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References