GitHub Advisoryadvisory · crates.io

GHSA-r626-fc64-3q28 Data race in abox

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-36441
Ecosystem
crates.io
Packages
abox
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-09

Affected packages

• crates.io abox: < 0.4.1 → fixed in 0.4.1

Description

Affected versions of this crate implements `Send`/`Sync` for `AtomicBox` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox` and trait bound `T: Sync` to `Sync` impl for `AtomicBox`.

Related

Alias · CVE (1)

  • CVE-2020-36441 An issue was discovered in the abox crate before 0.4.1 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References