GitHub Advisoryadvisory · crates.io

GHSA-w3g5-2848-2v8r Data races in generator

MEDIUM Published 2021-08-25 Modified 2021-08-24 Official page ↗
Aliases
CVE-2020-36471
Ecosystem
crates.io
Packages
generator
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-362
Reviewed
2021-08-18

Affected packages

• crates.io generator: < 0.7.0 → fixed in 0.7.0

Description

The `Generator` type is an iterable which uses a generator function that yields values. In affected versions of the crate, the provided function yielding values had no `Send` bounds despite the `Generator` itself implementing `Send`. The generator function lacking a `Send` bound means that types that are dangerous to send across threads such as `Rc` could be sent as part of a generator, potentially leading to data races. This flaw was fixed in commit `f7d120a3b` by enforcing that the generator function be bound by `Send`.

Related

Alias · CVE (1)

  • CVE-2020-36471 An issue was discovered in the generator crate before 0.7.0 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References