Reported

December 8, 2020

Issued

January 20, 2021 (last modified: June 13, 2023)

Package

gfwx (crates.io)

Type

Vulnerability

Categories

• memory-corruption
• thread-safety

Aliases

• CVE-2020-36211
• GHSA-xp6v-qx65-4pp7

References

• https://github.com/Devolutions/gfwx-rs/issues/7

CVSS Score

7 HIGH

CVSS Details

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality Impact

High

Integrity Impact

High

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Patched

• >=0.3.0

Description

In the affected versions of this crate, ImageChunkMut<'_, T> unconditionally implements Send and Sync, allowing to create data races.

This can result in a memory corruption or undefined behavior when non thread-safe types are moved and referenced across thread boundaries.

The flaw was corrected in commit e7fb2f5 by adding T: Send bound to the Send impl and adding T: Sync bound to the Sync impl.

Advisory available under CC0-1.0 license.