GitHub Advisoryadvisory · crates.io

GHSA-9mxw-4856-9cm5 Data races in rusb

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-36206
Ecosystem
crates.io
Packages
rusb
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-662, CWE-787
Reviewed
2021-08-19

Affected packages

• crates.io rusb: < 0.7.0 → fixed in 0.7.0

Description

Affected versions of rusb did not require UsbContext to implement Send and Sync. However, through Device and DeviceHandle it is possible to use UsbContexts across threads. This issue allows non-thread safe UsbContext types to be used concurrently leading to data races and memory corruption. The issue was fixed by adding Send and Sync bounds to UsbContext.

Related

Alias · CVE (1)

  • CVE-2020-36206 An issue was discovered in the rusb crate before 0.7.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-662 Improper Synchronization weakness
  • CWE-787 Out-of-bounds Write weakness

References