medium5.9
CVE-2020-36467
Multiple soundness issues in cgc
Impact
Affected versions of this crate have the following issues: 1. `Ptr` implements `Send` and `Sync` for all types, this can lead to data races by sending non-thread safe types across threads. 2. `Ptr::get` violates mutable alias rules by returning multiple mutable references to the same object. 3. `Ptr::write` uses non-atomic writes to the underlying pointer. This means that when used across threads it can lead to data races.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | cgc | <= 0.4.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cgc Project | Cgc | through 2020-12-10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/cgc/RUSTSEC-2020-0148.md
- https://rustsec.org/advisories/RUSTSEC-2020-0148.html
- https://github.com/advisories/GHSA-f3mq-99jr-ww4r
- https://nvd.nist.gov/vuln/detail/CVE-2020-36467
- https://github.com/playXE/cgc/issues/5