CVE-2020-36441 Data race in abox
The abox crate incorrectly implements Send and Sync, allowing data races that can lead to memory corruption or crashes in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36441?
CVE-2020-36441 is a high-severity vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Send and T: Sync.
Weakness: CWE-362
Which versions are affected by CVE-2020-36441?
3 open source packages ship an affected version, including abox. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
abox crates.io | All versions | 0.4.1 |
abox crates.io | All versions | 0.4.1 |
abox crates.io | From 0.0.0-0 | 0.4.1 |
Products include Abox Project Abox.
How do I fix CVE-2020-36441?
Upgrade abox to 0.4.1 or later.
Is CVE-2020-36441 being exploited?
There is no known exploitation of CVE-2020-36441 in the wild and no public exploit code.
Sources
Also known as GHSA-r626-fc64-3q28, RUSTSEC-2020-0121.