GitHub Advisoryadvisory · crates.io

GHSA-m7w4-8wp8-m2xq Data races in beef

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36442
Ecosystem
crates.io
Packages
beef
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-09

Affected packages

• crates.io beef: < 0.5.0 → fixed in 0.5.0

Description

An issue was discovered in the beef crate before 0.5.0 for Rust. Affected versions of this crate did not have a `T: Sync` bound in the `Send` impl for `Cow`. This allows users to create data races by making `Cow` contain types that are (Send && !Sync) like `Cell` or `RefCell`. Such data races can lead to memory corruption. The flaw was corrected in commit d1c7658 by adding trait bounds `T: Sync` and `T::Owned: Send` to the `Send` impl for `Cow`.

Related

Alias · CVE (1)

  • CVE-2020-36442 An issue was discovered in the beef crate before 0.5.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References