high8.1
CVE-2020-36438
Data race in tiny_future
Impact
tiny_future contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit `c791919` by adding trait bounds to Future's Send and Sync.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | tiny_future | < 0.4.0 | 0.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tiny Future Project | Tiny Future | before 0.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md
- https://rustsec.org/advisories/RUSTSEC-2020-0118.html
- https://github.com/advisories/GHSA-fg42-vwxx-xx5j
- https://nvd.nist.gov/vuln/detail/CVE-2020-36438
- https://github.com/KizzyCode/tiny_future/issues/1
- https://github.com/KizzyCode/tiny_future-rust/commit/c7919199a0f6d1ce0e3c33499d1b37f862c990e4