GHSA-r88h-6987-g79f

Dashboard / Vulnerabilities / GHSA-r88h-6987-g79f

GHSA-r88h-6987-g79f

Summary: Duplicate Advisory: Data races on syncpool

Details: ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vp6r-mrq9-8f4h. This link is maintained to preserve external references. ## Original Description Affected versions of this crate unconditionally implements `Send` for `Bucket2`. This allows sending non-Send types to other threads. This can lead to data races when non Send types like `Cell<T>` or `Rc<T>` are contained inside `Bucket2` and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue). The flaw was corrected in commit `15b2828` by adding a `T: Send` bound to the `Send` impl of `Bucket2<T>`.

References: https://github.com/Chopinsky/byte_buffer/issues/2, https://github.com/Chopinsky/byte_buffer/commit/15b282877d1e576de2b337d8162bbf43ed1a0f2d, https://github.com/Chopinsky/byte_buffer/tree/master/syncpool, https://github.com/RustSec/advisory-db/blob/main/crates/syncpool/RUSTSEC-2020-0142.md, https://rustsec.org/advisories/RUSTSEC-2020-0142.html