CVE-2020-36455 Slock<T> allows sending non-Send types across thread boundaries
The slock crate incorrectly implements Send and Sync, allowing data races that can lead to memory corruption or crashes in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36455?
CVE-2020-36455 is a high-severity vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync.
Weakness: CWE-77
Which versions are affected by CVE-2020-36455?
5 open source packages ship an affected version, including slock. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slock crates.io | All versions | 0.2.0 |
slock crates.io | All versions | 0.2.0 |
slock crates.io | All versions | 0.2.0 |
slock crates.io | All versions | 0.2.0 |
slock crates.io | From 0.0.0-0 | 0.2.0 |
Products include Brokenlamp Slock.
How do I fix CVE-2020-36455?
Upgrade slock to 0.2.0 or later.
Is CVE-2020-36455 being exploited?
There is no known exploitation of CVE-2020-36455 in the wild and no public exploit code.
Sources
Also known as GHSA-83r8-p8v6-6gfm, GHSA-mc36-5m36-hjh5, RUSTSEC-2020-0135.