RUSTSEC-2020-0140

    Dashboard / Vulnerabilities / RUSTSEC-2020-0140

    RUSTSEC-2020-0140

    Published: 10 Nov 2020Last Modified: 8 Nov 2023

    Summary: `Shared` can cause a data race

    Details: `Shared` data structure in `model` crate implements `Send` and `Sync` traits regardless of the inner type. This allows safe Rust code to trigger a data race, which is undefined behavior in Rust. Users are advised to treat `Shared` as an unsafe type. It should not be used outside of the testing context, and care must be taken so that the testing code does not have a data race besides a race condition that is expected to be caught by the test. Check [the Rustonomicon](https://doc.rust-lang.org/nomicon/races.html) for the difference between a data race and a general race condition.

    References: https://crates.io/crates/model, https://rustsec.org/advisories/RUSTSEC-2020-0140.html, https://github.com/spacejam/model/issues/3

    Affected packages

    Package

    Name: model

    Purl: pkg:cargo/model

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2020-0140 | CVE-DB