high8.1
CVE-2020-36450
Data races in bunch
Impact
An issue was discovered in the bunch crate through 2020-11-12 for Rust. Affected versions of this crate unconditionally implements `Send`/`Sync` for `Bunch<T>`. This allows users to insert `T: !Sync` to `Bunch<T>`. It is possible to create a data race to a `T: !Sync` by invoking the `Bunch::get()` API (which returns `&T`) from multiple threads. It is also possible to send `T: !Send` to other threads by inserting `T` inside `Bunch<T>` and sending `Bunch<T>` to another thread, allowing to create a data race by inserting types like `T = Rc<_>`. Such data races can lead to memory corruption.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | bunch | <= 0.1.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bunch Project | Bunch | through 2020-11-12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bunch/RUSTSEC-2020-0130.md
- https://rustsec.org/advisories/RUSTSEC-2020-0130.html
- https://github.com/advisories/GHSA-jwph-qp5h-f9wj
- https://nvd.nist.gov/vuln/detail/CVE-2020-36450
- https://github.com/krl/bunch/issues/1