high8.1
CVE-2020-36457
Data races in lever
Impact
An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T. This allows non-Send types such as Rc and non-Sync types such as Cell to be used across thread boundaries which can trigger undefined behavior and memory corruption.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | lever | < 0.1.1 | 0.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lever Project | Lever | Versions 0.0.0, 0.1.0, 0.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lever/RUSTSEC-2020-0137.md
- https://rustsec.org/advisories/RUSTSEC-2020-0137.html
- https://github.com/advisories/GHSA-9pp4-8p8v-g78w
- https://nvd.nist.gov/vuln/detail/CVE-2020-36457
- https://github.com/vertexclique/lever/issues/15
- https://github.com/vertexclique/lever/pull/17
- https://github.com/vertexclique/lever/commit/4a4cca61cdb25061967d58522229e147483007b1