CVE-2020-35925 Data races in magnetic
The magnetic crate allows cross-thread sending of non-Send types, potentially causing undefined behavior or memory safety violations in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35925?
CVE-2020-35925 is a medium-severity vulnerability in n/a, published on 31 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
Which versions are affected by CVE-2020-35925?
3 open source packages ship an affected version, including magnetic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
magnetic crates.io | All versions | 2.0.1 |
magnetic crates.io | All versions | 2.0.1 |
magnetic crates.io | From 0.0.0-0 | 2.0.1 |
Products include Magnetic Project Magnetic.
How do I fix CVE-2020-35925?
Upgrade magnetic to 2.0.1 or later.
Is CVE-2020-35925 being exploited?
There is no known exploitation of CVE-2020-35925 in the wild and no public exploit code.
Sources
Also known as GHSA-wv4p-jp67-jr97, RUSTSEC-2020-0088.