RUSTSEC-2020-0112

ButtplugFutureStateShared allows data race to (!Send|!Sync) objects

Reported

December 18, 2020

Issued

January 20, 2021 (last modified: October 19, 2021)

Package

buttplug (crates.io)

Type

Vulnerability

Categories

Aliases

CVE-2020-36218

Details

https://github.com/buttplugio/buttplug-rs/issues/225

CVSS Score

5.9 MEDIUM

CVSS Details

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=1.0.4

Description

ButtplugFutureStateShared<T> implements Send & Sync regardless of T.

If T: !Send for ButtplugFutureStateShared<T>, it is possible to move non-Send types across thread boundaries (e.g. T=Rc<T>) and lead to undefined behavior. If T: !Sync for ButtplugFutureStateShared<T>, it is possible to cause data race to T (e.g. T=Arc<Cell<_>>) and lead to undefined behavior.

The flaw was corrected in version 1.0.4 by removing manual implementations of Send/Sync for ButtplugFutureStateShared<T> to let rustc generate auto trait implementations with correct trait bounds on T.