HIGH8.1
GHSA-r626-fc64-3q28
Data race in abox
Details
Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-36441[ADVISORY]
- https://github.com/SonicFrog/abox/issues/1[WEB]
- https://github.com/SonicFrog/abox/pull/2[WEB]
- https://github.com/SonicFrog/abox/commit/34c2b9e[WEB]
- https://github.com/SonicFrog/abox[PACKAGE]
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md[WEB]
- https://rustsec.org/advisories/RUSTSEC-2020-0121.html[WEB]