PT-2020-17621 · Rust · Abox

Published 2020-11-10 · Updated 2021-08-25 · CVE-2020-36441

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions abox crate versions prior to 0.4.1

Description An issue in the abox crate allows the implementation of Send and Sync for AtomicBox<T> without requiring T: Send and T: Sync. This enables the creation of data races to T: !Sync and sending T: !Send to another thread, breaking Rust's compile-time thread safety guarantees and potentially leading to undefined behavior, such as memory corruption from data races.

Recommendations For abox crate versions prior to 0.4.1, update to version 0.4.1 or later, which includes the corrected implementation with added trait bounds T: Send and T: Sync for Send and Sync impl respectively.

Fix

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-36441

GHSA-R626-FC64-3Q28

RUSTSEC-2020-0121

Affected Products

Abox

References · 11

• https://osv.dev/vulnerability/GHSA-r626-fc64-3q28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36441 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36441 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0121 · Vendor Advisory
• https://github.com/SonicFrog/abox/issues/1 · Note
• https://github.com/SonicFrog/abox/commit/34c2b9e · Note
• https://github.com/SonicFrog/abox/pull/2 · Note
• https://github.com/SonicFrog/abox · Note
• https://crates.io/crates/abox · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0121.html · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md · Note