high8.1
CVE-2020-36448
Data races in cache
Impact
An issue was discovered in the cache crate through 2020-11-24 for Rust. Affected versions of this crate unconditionally implement Send/Sync for `Cache<K>`. This allows users to insert `K` that is not Send or not Sync. This allows users to create data races by using non-Send types like `Arc<Cell<T>>` or `Rc<T>` as `K` in `Cache<K>`. It is also possible to create data races by using types like `Cell<T>` or `RefCell<T>` (types that are `Send` but not `Sync`). Such data races can lead to memory corruption.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | cache | <= 0.2.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cache Project | Cache | through 2020-11-24 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cache/RUSTSEC-2020-0128.md
- https://rustsec.org/advisories/RUSTSEC-2020-0128.html
- https://github.com/advisories/GHSA-g78p-g85h-q6ww
- https://nvd.nist.gov/vuln/detail/CVE-2020-36448
- https://github.com/krl/cache/issues/1