CVE-2020-35905: MutexGuard::map can cause a data race in safe code

May 24, 2022 (updated June 13, 2023)

Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U.

This could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T.

The issue was fixed by fixing Send and Sync implementations, and by adding a PhantomData<&‘a mut U> marker to the MappedMutexGuard type to tell the compiler that the guard is over U too.

References

github.com/advisories/GHSA-rh4w-94hh-9943
github.com/rust-lang/futures-rs
github.com/rust-lang/futures-rs/issues/2239
nvd.nist.gov/vuln/detail/CVE-2020-35905
rustsec.org/advisories/RUSTSEC-2020-0059.html

Code Behaviors & Features

Detect and mitigate CVE-2020-35905 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →