GitHub Advisoryadvisory · crates.io

GHSA-m296-j53x-xv95 Data races in tiny_future

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Ecosystem
crates.io
Packages
tiny_future
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362
Reviewed
2021-08-05

Affected packages

• crates.io tiny_future: < 0.4.0 → fixed in 0.4.0

Description

`tiny_future` contains a light-weight implementation of `Future`s. The `Future` type it has lacked bound on its `Send` and `Sync` traits. This allows for a bug where non-thread safe types such as `Cell` can be used in `Future`s and cause data races in concurrent programs. The flaw was corrected in commit `c791919` by adding trait bounds to `Future`'s `Send` and `Sync`.

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References