GitHub Advisoryadvisory · crates.io

GHSA-rpxm-vmr7-5f5f Data races in convec

HIGH Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36445
Ecosystem
crates.io
Packages
convec
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119, CWE-362
Reviewed
2021-08-09

Affected packages

• crates.io convec: <= 2.0.1 (no fix yet)

Description

Affected versions of this crate unconditionally implement Send/Sync for `ConVec`. This allows users to insert `T` that is not Send or not Sync. This allows users to create data races by using non-Send types like `Arc>` or `Rc` as `T` in `ConVec`. It is also possible to create data races by using types like `Cell` or `RefCell` as `T` (types that are `Send` but not `Sync`). Such data races can lead to memory corruption.

Related

Alias · CVE (1)

  • CVE-2020-36445 An issue was discovered in the convec crate through 2020-11-24 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References