RUSTSEC-2020-0061

Dashboard / Vulnerabilities / RUSTSEC-2020-0061

RUSTSEC-2020-0061

Summary: futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer

Details: Affected versions of the crate used a `UnsafeCell` in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread. This resulted in a segmentation fault crash if `Waker::wake_by_ref()` was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn't accessible from the main thread. Reproduction Example (from issue): ```rust use futures_task::noop_waker_ref; fn main() { let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap(); waker.wake_by_ref(); } ``` The flaw was corrected by using a `OnceCell::Lazy<>` wrapper around the noop waker instead of thread-local storage.

References: https://crates.io/crates/futures-task, https://rustsec.org/advisories/RUSTSEC-2020-0061.html, https://github.com/rust-lang/futures-rs/issues/2091