CVE-2020-35905 MutexGuard::map can cause a data race in safe code
A data race in the futures-util crate allows unsafe memory access in safe code, potentially leading to undefined behavior or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35905?
CVE-2020-35905 is a medium-severity vulnerability in n/a, published on 31 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).
Weakness: CWE-362
Which versions are affected by CVE-2020-35905?
3 open source packages ship an affected version, including futures-util. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
futures-util crates.io | From 0.3.2 | 0.3.7 |
futures-util crates.io | From 0.3.2 | 0.3.7 |
futures-util crates.io | From 0.3.2 | 0.3.7 |
Products include Rust-Lang Future-Utils.
How do I fix CVE-2020-35905?
Upgrade futures-util to 0.3.7 or later.
Is CVE-2020-35905 being exploited?
There is no known exploitation of CVE-2020-35905 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rh4w-94hh-9943, RUSTSEC-2020-0059.