VDB
Sign up
HIGH8.1

GHSA-r626-fc64-3q28

Data race in abox

Details

Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/abox
Introduced in: 0Fixed in: 0.4.1

Upgrade abox to 0.4.1 or newer (ecosystem crates.io).

References