Reported

November 10, 2020

Issued

January 20, 2021 (last modified: October 25, 2024)

Package

may_queue (crates.io)

Type

Vulnerability

Categories

• memory-corruption
• thread-safety

Keywords

#concurrency

Aliases

• CVE-2020-36217
• GHSA-pphf-f93w-gc84

References

• https://github.com/Xudong-Huang/may/issues/88

CVSS Score

5.9 MEDIUM

CVSS Details

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

• >=0.1.8

Description

Affected versions of may_queue implements Send/Sync for its Queue type without restricting it to Sendable types and Syncable types.

This allows non-Sync types such as Cell to be shared across threads leading to undefined behavior and memory corruption in concurrent programs.

Advisory available under CC0-1.0 license.