PT-2020-17557 · Rust · Magnetic Crate

Published 2020-11-29 · Updated 2021-08-25 · CVE-2020-35925

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions magnetic crate versions prior to 2.0.1

Description An issue in the magnetic crate allows cross-thread sending of a non-Send type, which can cause a data race. The affected versions unconditionally implemented Sync and Send traits for MPMCConsumer and MPMCProducer types, enabling users to send types that do not implement the Send trait across thread boundaries.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later, which includes the correction by adding the T: Send bound to affected Sync/Send trait implementations. As a temporary workaround, consider avoiding the use of MPMCConsumer and MPMCProducer types to send non-Send types across thread boundaries until the update is applied.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2020-35925

GHSA-WV4P-JP67-JR97

RUSTSEC-2020-0088

Affected Products

Magnetic Crate

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0088.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35925 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0088 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35925 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wv4p-jp67-jr97 · Vendor Advisory
• https://github.com/johnshaw/magnetic/issues/9 · Note
• https://github.com/johnshaw/magnetic · Note
• https://crates.io/crates/magnetic · Note