GitHub Advisoryadvisory · crates.io

GHSA-9pp4-8p8v-g78w Data races in lever

HIGH Published 2021-08-25 Modified 2021-08-18 Official page ↗
Aliases
CVE-2020-36457
Ecosystem
crates.io
Packages
lever
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362, CWE-77
Reviewed
2021-08-18

Affected packages

• crates.io lever: < 0.1.1 → fixed in 0.1.1

Description

An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox implements the Send and Sync traits for all types T. This allows non-Send types such as Rc and non-Sync types such as Cell to be used across thread boundaries which can trigger undefined behavior and memory corruption.

Related

Alias · CVE (1)

  • CVE-2020-36457 An issue was discovered in the lever crate before 0.1.1 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References