~ / search / GHSA-686f-ch3r-xwmh

GHSA-686f-ch3r-xwmh

Data races in unicycle

Source: GitHub Advisory Database (reviewed) High CVE-2020-36436

Packages

EcosystemPackageAffectedFixed in
crates.io unicycle < 0.7.1 0.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of this crate unconditionally implemented `Send` & `Sync` for types `PinSlab<T>` & `Unordered<T, S>`. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads. This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within `PinSlab<T>` or `Unordered<T, S>` and accessed concurrently from multiple threads. The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound `T: Send` to `Send` impls for `PinSlab<T>` & `Unordered<T, S>` and adding `T: Sync` to `Sync` impls for `PinSlab<T>` & `Unordered<T, S>`.

References

External links from the advisory. They lead to third-party sites.