CVE-2020-36436: Data races in unicycle
Affected versions of this crate unconditionally implemented Send & Sync for types PinSlab<T> & Unordered<T, S>. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads.
This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within PinSlab<T> or Unordered<T, S> and accessed concurrently from multiple threads.
The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound T: Send to Send impls for PinSlab<T> & Unordered<T, S> and adding T: Sync to Sync impls for PinSlab<T> & Unordered<T, S>.
References
- github.com/advisories/GHSA-686f-ch3r-xwmh
- github.com/udoprog/unicycle
- github.com/udoprog/unicycle/commit/6a6c367a0c25f86f998fa315ea90c328f685b194
- github.com/udoprog/unicycle/commit/92f40b4a2c671553dfa96feacff0265206c44ce5
- github.com/udoprog/unicycle/issues/8
- nvd.nist.gov/vuln/detail/CVE-2020-36436
- raw.githubusercontent.com/rustsec/advisory-db/main/crates/unicycle/RUSTSEC-2020-0116.md
- rustsec.org/advisories/RUSTSEC-2020-0116.html
Code Behaviors & Features
Detect and mitigate CVE-2020-36436 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →