Reported

November 17, 2020

Issued

December 7, 2020 (last modified: June 13, 2023)

Package

try-mutex (crates.io)

Type

Vulnerability

Categories

• thread-safety

Aliases

• CVE-2020-35924
• GHSA-64j8-7gp2-xjx5

References

• https://github.com/mpdn/try-mutex/issues/2

CVSS Score

5.5 MEDIUM

CVSS Details

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality Impact

None

Integrity Impact

None

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Patched

• >=0.3.0

Description

Affected versions of this crate unconditionally implemented Sync trait for TryMutex<T> type.

This allows users to put non-Send T type in TryMutex and send it to another thread, which can cause a data race.

The flaw was corrected in the 0.3.0 release by adding T: Send bound for the Sync trait implementation.

Advisory available under CC0-1.0 license.