CVE-2020-36440: Data races in libsbc

August 25, 2021

Affected versions of this crate implements Send for Decoder<R> for any R: Read. This allows Decoder<R> to contain R: !Send and carry (move) it to another thread.

This can result in undefined behavior such as memory corruption from data race on R, or dropping R = MutexGuard<_> from a thread that didn’t lock the mutex.

The flaw was corrected in commit a34d6e1 by adding trait bound R: Send to the Send impl for Decoder<R>.

References

github.com/advisories/GHSA-f6g6-54hm-fhxv
github.com/mvertescher/libsbc-rs
github.com/mvertescher/libsbc-rs/commit/a34d6e1
nvd.nist.gov/vuln/detail/CVE-2020-36440
raw.githubusercontent.com/rustsec/advisory-db/main/crates/libsbc/RUSTSEC-2020-0120.md
rustsec.org/advisories/RUSTSEC-2020-0120.html

Code Behaviors & Features

Detect and mitigate CVE-2020-36440 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →