HistoryEditJSON (OSV)

RUSTSEC-2020-0138

ReaderResult should be bounded by Sync

Reported
Issued
Package
lexer (crates.io)
Type
Vulnerability
Categories
Aliases
References
CVSS Score
8.1 HIGH
CVSS Details
Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Patched
no patched versions

Description

Affected versions of this crate implements Sync for ReaderResult<T, E> with the trait bound T: Send, E: Send.

Since matching on the public enum ReaderResult<T, E> provides access to &T & &E, allowing data race to a non-Sync type T or E. This can result in a memory corruption when multiple threads concurrently access &T or &E.

Suggested fix for the bug is change the trait bounds imposed on T & E to be T: Sync, E: Sync.

Advisory available under CC0-1.0 license.