GitHub Advisoryadvisory · crates.io

GHSA-g78p-g85h-q6ww Data races in cache

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36448
Ecosystem
crates.io
Packages
cache
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362, CWE-77
Reviewed
2021-08-18

Affected packages

• crates.io cache: <= 0.2.0 (no fix yet)

Description

An issue was discovered in the cache crate through 2020-11-24 for Rust. Affected versions of this crate unconditionally implement Send/Sync for `Cache`. This allows users to insert `K` that is not Send or not Sync. This allows users to create data races by using non-Send types like `Arc>` or `Rc` as `K` in `Cache`. It is also possible to create data races by using types like `Cell` or `RefCell` (types that are `Send` but not `Sync`). Such data races can lead to memory corruption.

Related

Alias · CVE (1)

  • CVE-2020-36448 An issue was discovered in the cache crate through 2020-11-24 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References