CVE-2020-36211: Data races in gfwx

August 25, 2021 (updated June 13, 2023)

In the affected versions of this crate, ImageChunkMut<’_, T> unconditionally implements Send and Sync, allowing to create data races.

This can result in a memory corruption or undefined behavior when non thread-safe types are moved and referenced across thread boundaries.

The flaw was corrected in commit e7fb2f5 by adding T: Send bound to the Send impl and adding T: Sync bound to the Sync impl.

References

github.com/Devolutions/gfwx-rs
github.com/Devolutions/gfwx-rs/issues/7
github.com/advisories/GHSA-xp6v-qx65-4pp7
nvd.nist.gov/vuln/detail/CVE-2020-36211
rustsec.org/advisories/RUSTSEC-2020-0104.html

Code Behaviors & Features

Detect and mitigate CVE-2020-36211 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →