GHSA-jh2g-xhqq-x4w9: Send/Sync bound needed on T for Send/Sync impl of RcuCell<T>

August 25, 2021

Affected versions of this crate unconditionally implement Send/Sync for RcuCell<T>. This allows users to send T: !Send to other threads (while T enclosed within RcuCell<T>), and allows users to concurrently access T: !Sync by using the APIs of RcuCell<T> that provide access to &T.

This can result in memory corruption caused by data races.

References

github.com/Xudong-Huang/rcu_cell
github.com/Xudong-Huang/rcu_cell/issues/3
github.com/Xudong-Huang/rcu_cell/pull/4/commits/1faf18eee11f14969b77ae0f76dcd9ebd437d0c2
github.com/advisories/GHSA-jh2g-xhqq-x4w9
rustsec.org/advisories/RUSTSEC-2020-0131.html

Code Behaviors & Features

Detect and mitigate GHSA-jh2g-xhqq-x4w9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →