CVE-2020-35908 Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
A race condition in the futures-util crate allows data corruption due to mishandled synchronization, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35908?
CVE-2020-35908 is a medium-severity vulnerability in n/a, published on 31 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
Which versions are affected by CVE-2020-35908?
3 open source packages ship an affected version, including futures-util. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
futures-util crates.io | From 0.3.0 | 0.3.2 |
futures-util crates.io | From 0.3.0 | 0.3.2 |
futures-util crates.io | From 0.3.0 | 0.3.2 |
Products include Rust-Lang Future-Utils.
How do I fix CVE-2020-35908?
Upgrade futures-util to 0.3.2 or later.
Is CVE-2020-35908 being exploited?
There is no known exploitation of CVE-2020-35908 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5r9g-j7jj-hw6c, RUSTSEC-2020-0062.