GitHub Advisoryadvisory · crates.io

GHSA-686h-j8r8-wmfm Data races in rcu_cell

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36451
Ecosystem
crates.io
Packages
rcu_cell
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362, CWE-77
Reviewed
2021-08-18

Affected packages

• crates.io rcu_cell: < 0.1.9 → fixed in 0.1.9

Description

Affected versions of this crate unconditionally implement Send/Sync for `RcuCell`. This allows users to send `T: !Send` to other threads (while `T` enclosed within `RcuCell`), and allows users to concurrently access `T: !Sync` by using the APIs of `RcuCell` that provide access to `&T`. This can result in memory corruption caused by data races.

Related

Alias · CVE (1)

  • CVE-2020-36451 An issue was discovered in the rcu_cell crate through 2020-11-14 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References