GitHub Advisoryadvisory · crates.io

GHSA-q2gj-9r85-p832 Data races in rulinalg

CRITICAL Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35879
Ecosystem
crates.io
Packages
rulinalg
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362
Reviewed
2021-08-19

Affected packages

• crates.io rulinalg: >= 0.4.0, <= 0.4.2 (no fix yet)

Description

The affected version of rulinalg has incorrect lifetime boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut. They do not conform with Rust's borrowing rule and allows the user to create multiple mutable references to the same location. This may result in unexpected calculation result and data race if both references are used at the same time.

Related

Alias · CVE (1)

  • CVE-2020-35879 An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References