GitHub Advisoryadvisory · crates.io

GHSA-fg42-vwxx-xx5j Data race in tiny_future

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-36438
Ecosystem
crates.io
Packages
tiny_future
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-09

Affected packages

• crates.io tiny_future: < 0.4.0 → fixed in 0.4.0

Description

tiny_future contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit `c791919` by adding trait bounds to Future's Send and Sync.

Related

Alias · CVE (1)

  • CVE-2020-36438 An issue was discovered in the tiny_future crate before 0.4.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References