high8.1
CVE-2020-36444
Data races in async-coap
Impact
An issue was discovered in the async-coap crate through 2020-12-08 for Rust. Affected versions of this crate implement Send/Sync for `ArcGuard<RC, T>` with no trait bounds on `RC`. This allows users to send `RC: !Send` to other threads and also allows users to concurrently access `Rc: !Sync` from multiple threads. This can result in memory corruption from data race or other undefined behavior caused by sending `T: !Send` to other threads (e.g. dropping `MutexGuard<T>` in another thread that didn't lock its mutex).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | async-coap | <= 0.1.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Async-Coap Project | Async-Coap | through 2020-12-08 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/async-coap/RUSTSEC-2020-0124.md
- https://rustsec.org/advisories/RUSTSEC-2020-0124.html
- https://github.com/advisories/GHSA-9j8q-m9x5-9g6j
- https://nvd.nist.gov/vuln/detail/CVE-2020-36444
- https://github.com/google/rust-async-coap/issues/33