PT-2020-17586 · Rust · Multiqueue2
Published
2020-12-19
·
Updated
2021-08-25
·
CVE-2020-36214
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
multiqueue2 crate versions prior to 0.1.7
Description
An issue in the multiqueue2 crate allows users to send non-Send types to other threads, which can lead to data race bugs or other undefined behavior. This occurs because the crate unconditionally implemented
Send for types used in queue implementations, including InnerSend<RW, T>, InnerRecv<RW, T>, FutInnerSend<RW, T>, and FutInnerRecv<RW, T>. The flaw was corrected by adding a T: Send bound to the Send implementation of these data types.Recommendations
For versions prior to 0.1.7, update to version 0.1.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable queue implementations to prevent sending non-Send types to other threads.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Multiqueue2