Skip to content

Data races in unicycle

Moderate severity GitHub Reviewed Published Aug 25, 2021 to the GitHub Advisory Database • Updated Jan 9, 2023
Withdrawn This advisory was withdrawn on Aug 24, 2021

Package

unicycle (Rust)

Affected versions

< 0.7.1

Patched versions

0.7.1

Description

Affected versions of this crate unconditionally implemented Send & Sync for types PinSlab<T> & Unordered<T, S>. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads.

This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within PinSlab<T> or Unordered<T, S> and accessed concurrently from multiple threads.

The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound T: Send to Send impls for PinSlab<T> & Unordered<T, S> and adding T: Sync to Sync impls for PinSlab<T> & Unordered<T, S>.

References

Reviewed Aug 5, 2021
Withdrawn Aug 24, 2021
Published to the GitHub Advisory Database Aug 25, 2021
Last updated Jan 9, 2023

Severity

Moderate

EPSS score

Weaknesses

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-7mg7-m5c3-3hqj

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.