GitHub Advisoryadvisory · crates.io

GHSA-fqq2-xp7m-xvm8 Data race in ruspiro-singleton

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36435
Ecosystem
crates.io
Packages
ruspiro-singleton
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-18

Affected packages

• crates.io ruspiro-singleton: < 0.4.1 → fixed in 0.4.1

Description

`Singleton` is meant to be a static object that can be initialized lazily. In order to satisfy the requirement that `static` items must implement `Sync`, `Singleton` implemented both `Sync` and `Send` unconditionally. This allows for a bug where non-`Sync` types such as `Cell` can be used in singletons and cause data races in concurrent programs. The flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring the contaiend type to implement `Sync`.

Related

Alias · CVE (1)

  • CVE-2020-36435 An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References