GitHub Advisoryadvisory · crates.io

GHSA-vp6r-mrq9-8f4h Data race in syncpool

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-36462
Ecosystem
crates.io
Packages
syncpool
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362, CWE-77
Reviewed
2021-08-18

Affected packages

• crates.io syncpool: < 0.1.6 → fixed in 0.1.6

Description

Affected versions of this crate unconditionally implements Send for Bucket2. This allows sending non-Send types to other threads. This can lead to data races when non Send types like Cell or Rc are contained inside Bucket2 and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue). The flaw was corrected in commit `15b2828` by adding a T: Send bound to the Send impl of Bucket2.

Related

Alias · CVE (1)

  • CVE-2020-36462 An issue was discovered in the syncpool crate before 0.1.6 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References