GitHub Advisoryadvisory · crates.io

GHSA-f6g6-54hm-fhxv Data races in libsbc

HIGH Published 2021-08-25 Modified 2021-08-18 Official page ↗
Aliases
CVE-2020-36440
Ecosystem
crates.io
Packages
libsbc
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-09

Affected packages

• crates.io libsbc: < 0.1.5 → fixed in 0.1.5

Description

Affected versions of this crate implements `Send` for `Decoder` for any `R: Read`. This allows `Decoder` to contain `R: !Send` and carry (move) it to another thread. This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard` from a thread that didn't lock the mutex. The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder`.

Related

Alias · CVE (1)

  • CVE-2020-36440 An issue was discovered in the libsbc crate before 0.1.5 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References