HIGH8.1
GHSA-9j8q-m9x5-9g6j
Data races in async-coap
Details
An issue was discovered in the async-coap crate through 2020-12-08 for Rust. Affected versions of this crate implement Send/Sync for `ArcGuard<RC, T>` with no trait bounds on `RC`. This allows users to send `RC: !Send` to other threads and also allows users to concurrently access `Rc: !Sync` from multiple threads.
This can result in memory corruption from data race or other undefined behavior caused by sending `T: !Send` to other threads (e.g. dropping `MutexGuard<T>` in another thread that didn't lock its mutex).
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/async-coap
Introduced in:
0No fixed version published yet for async-coap. Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-36444[ADVISORY]
- https://github.com/google/rust-async-coap/issues/33[WEB]
- https://github.com/google/rust-async-coap[PACKAGE]
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/async-coap/RUSTSEC-2020-0124.md[WEB]
- https://rustsec.org/advisories/RUSTSEC-2020-0124.html[WEB]