PT-2020-17540 · Rust · Futures-Util

Published 2020-01-24 · Updated 2022-05-24 · CVE-2020-35908

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions futures-util crate versions prior to 0.3.2

Description The issue concerns the FuturesUnordered structure in the futures-util crate, where an unsound Sync implementation can lead to data corruption due to mishandled synchronization. Specifically, the use of a Cell for interior mutability without proper access synchronization to the underlying task list's length and head can cause incorrect values to be seen by multiple threads modifying the list simultaneously.

Recommendations For versions prior to 0.3.2, update to version 0.3.2 or later to fix the issue by adding access synchronization code around task insertion into the list.

Fix

Related Identifiers

CVE-2020-35908

GHSA-5R9G-J7JJ-HW6C

RUSTSEC-2020-0062

Affected Products

Futures-Util

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-35908 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0062 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35908 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5r9g-j7jj-hw6c · Vendor Advisory
• https://github.com/rust-lang/futures-rs/issues/2050 · Note
• https://github.com/rust-lang/futures-rs · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0062.html · Note
• https://crates.io/crates/futures-util · Note