PT-2020-17647 · Rust · Cgc Crate
Published
2020-12-10
·
Updated
2021-08-25
·
CVE-2020-36466
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
cgc crate versions through 2020-12-10
Description
The issue concerns the
Ptr implementation in the cgc crate, which implements Send and Sync for all types. This can lead to data races by sending non-thread safe types across threads. Additionally, Ptr::get violates mutable alias rules by returning multiple mutable references to the same object, and Ptr::write uses non-atomic writes to the underlying pointer, leading to potential data races when used across threads.Recommendations
As a temporary workaround, consider disabling the
Ptr implementation until a patch is available.
Restrict access to the Ptr::get and Ptr::write functions to minimize the risk of exploitation.
Avoid using the Ptr implementation across threads until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cgc Crate