~ / search / GHSA-r626-fc64-3q28

GHSA-r626-fc64-3q28

Data race in abox

Source: GitHub Advisory Database (reviewed) High CVE-2020-36441

Packages

EcosystemPackageAffectedFixed in
crates.io abox < 0.4.1 0.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.

References

External links from the advisory. They lead to third-party sites.