GHSA-9mxw-4856-9cm5

Data races in rusb

Source: GitHub Advisory Database (reviewed) High CVE-2020-36206

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	rusb	< 0.7.0	0.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of rusb did not require UsbContext to implement Send and Sync. However, through Device and DeviceHandle it is possible to use UsbContexts across threads. This issue allows non-thread safe UsbContext types to be used concurrently leading to data races and memory corruption. The issue was fixed by adding Send and Sync bounds to UsbContext.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36206 advisory
https://github.com/a1ien/rusb/issues/44 web
https://github.com/a1ien/rusb package
https://rustsec.org/advisories/RUSTSEC-2020-0098.html web