HistoryEditJSON (OSV)

RUSTSEC-2020-0101

conquer-once's OnceCell lacks Send bound for its Sync trait.

Reported
Issued
Package
conquer-once (crates.io)
Type
Vulnerability
Categories
Keywords
#concurrency
Aliases
References
CVSS Score
7.8 HIGH
CVSS Details
Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Patched
  • >=0.3.2

Description

Affected versions of conquer-once implements Sync for its OnceCell type without restricting it to Sendable types.

This allows non-Send but Sync types such as MutexGuard to be sent across threads leading to undefined behavior and memory corruption in concurrent programs.

The issue was fixed by adding a Send constraint to OnceCell.

Advisory available under CC0-1.0 license.