{"id":"CVE-2020-36441","aliases":["RUSTSEC-2020-0121"],"url":"https://o3.security/vulnerability/CVE-2020-36441","summary":"Data race in abox","details":"Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.","published":"2021-08-25T20:59:06Z","modified":"2023-11-08T04:03:45.024840Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"abox","fixedVersion":"0.4.1"}],"fix":{"url":"https://github.com/SonicFrog/abox/pull/2","label":"SonicFrog/abox#2"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36441"},{"type":"WEB","url":"https://github.com/SonicFrog/abox/issues/1"},{"type":"WEB","url":"https://github.com/SonicFrog/abox/pull/2"},{"type":"WEB","url":"https://github.com/SonicFrog/abox/commit/34c2b9e"},{"type":"PACKAGE","url":"https://github.com/SonicFrog/abox"},{"type":"WEB","url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2020-0121.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:03:45.024840Z"}}