GitHub Advisoryadvisory · crates.io

GHSA-jwph-qp5h-f9wj Data races in bunch

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36450
Ecosystem
crates.io
Packages
bunch
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362, CWE-77
Reviewed
2021-08-09

Affected packages

• crates.io bunch: <= 0.1.0 (no fix yet)

Description

An issue was discovered in the bunch crate through 2020-11-12 for Rust. Affected versions of this crate unconditionally implements `Send`/`Sync` for `Bunch`. This allows users to insert `T: !Sync` to `Bunch`. It is possible to create a data race to a `T: !Sync` by invoking the `Bunch::get()` API (which returns `&T`) from multiple threads. It is also possible to send `T: !Send` to other threads by inserting `T` inside `Bunch` and sending `Bunch` to another thread, allowing to create a data race by inserting types like `T = Rc`. Such data races can lead to memory corruption.

Related

Alias · CVE (1)

  • CVE-2020-36450 An issue was discovered in the bunch crate through 2020-11-12 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References