high8.1
CVE-2020-36442
Data races in beef
Impact
An issue was discovered in the beef crate before 0.5.0 for Rust. Affected versions of this crate did not have a `T: Sync` bound in the `Send` impl for `Cow<'_, T, U>`. This allows users to create data races by making `Cow` contain types that are (Send && !Sync) like `Cell<_>` or `RefCell<_>`. Such data races can lead to memory corruption. The flaw was corrected in commit d1c7658 by adding trait bounds `T: Sync` and `T::Owned: Send` to the `Send` impl for `Cow<'_, T, U>`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | beef | < 0.5.0 | 0.5.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Beef Project | Beef | before 0.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/beef/RUSTSEC-2020-0122.md
- https://rustsec.org/advisories/RUSTSEC-2020-0122.html
- https://github.com/advisories/GHSA-m7w4-8wp8-m2xq
- https://nvd.nist.gov/vuln/detail/CVE-2020-36442
- https://github.com/maciejhirsz/beef/issues/37