high8.1
CVE-2020-36440
Data races in libsbc
Impact
Affected versions of this crate implements `Send` for `Decoder<R>` for any `R: Read`. This allows `Decoder<R>` to contain `R: !Send` and carry (move) it to another thread. This can result in undefined behavior such as memory corruption from data race on `R`, or dropping `R = MutexGuard<_>` from a thread that didn't lock the mutex. The flaw was corrected in commit a34d6e1 by adding trait bound `R: Send` to the `Send` impl for `Decoder<R>`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | libsbc | < 0.1.5 | 0.1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Libsbc Project | Libsbc | before 0.1.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libsbc/RUSTSEC-2020-0120.md
- https://rustsec.org/advisories/RUSTSEC-2020-0120.html
- https://github.com/advisories/GHSA-f6g6-54hm-fhxv
- https://nvd.nist.gov/vuln/detail/CVE-2020-36440
- https://github.com/mvertescher/libsbc-rs/commit/a34d6e1