CVE-2020-36472: Data races in max7301

August 25, 2021

The ImmediateIO and TransactionalIO types implement Sync for all contained Expander<EI> types regardless of if the Expander itself is safe to use across threads.

As the IO types allow retrieving the Expander, this can lead to non-thread safe types being sent across threads as part of the Expander leading to data races.

References

github.com/advisories/GHSA-rmff-f8w9-c9rm
github.com/edarc/max7301
github.com/edarc/max7301/commit/0a1da873ddb29bca926bad8301f8d7ab8aa97c52
github.com/edarc/max7301/issues/1
nvd.nist.gov/vuln/detail/CVE-2020-36472
rustsec.org/advisories/RUSTSEC-2020-0152.html

Code Behaviors & Features

Detect and mitigate CVE-2020-36472 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →