GitHub Advisoryadvisory · crates.io

GHSA-rh4w-94hh-9943 MutexGuard::map can cause a data race in safe code

MEDIUM Published 2022-05-24 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35905
Ecosystem
crates.io
Packages
futures-util
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-362
Reviewed
2022-06-16

Affected packages

• crates.io futures-util: >= 0.3.2, < 0.3.7 → fixed in 0.3.7

Description

Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U. This could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T. The issue was fixed by fixing Send and Sync implementations, and by adding a PhantomData marker to the MappedMutexGuard type to tell the compiler that the guard is over U too.

Related

Alias · CVE (1)

  • CVE-2020-35905 An issue was discovered in the futures-util crate before 0.3.7 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References