GitHub Advisoryadvisory · crates.io

GHSA-9j8q-m9x5-9g6j Data races in async-coap

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36444
Ecosystem
crates.io
Packages
async-coap
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-09

Affected packages

• crates.io async-coap: <= 0.1.0 (no fix yet)

Description

An issue was discovered in the async-coap crate through 2020-12-08 for Rust. Affected versions of this crate implement Send/Sync for `ArcGuard` with no trait bounds on `RC`. This allows users to send `RC: !Send` to other threads and also allows users to concurrently access `Rc: !Sync` from multiple threads. This can result in memory corruption from data race or other undefined behavior caused by sending `T: !Send` to other threads (e.g. dropping `MutexGuard` in another thread that didn't lock its mutex).

Related

Alias · CVE (1)

  • CVE-2020-36444 An issue was discovered in the async-coap crate through 2020-12-08 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References