GHSA-36xm-35qq-795w Exposes reference to non-Sync data to an arbitrary thread
The inventory crate allows thread-unsafe data to be accessed concurrently, potentially causing race conditions, crashes, or memory corruption in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-36xm-35qq-795w?
GHSA-36xm-35qq-795w is a vulnerability in inventory, published on 10 Sep 2023.
Official description
Affected versions do not enforce a Sync bound on the type of caller-provided
value held in the plugin registry. References to these values are made
accessible to arbitrary threads other than the one that constructed them.
A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.
The flaw was corrected by enforcing that data submitted by the caller into
inventory is Sync.
Which versions are affected by GHSA-36xm-35qq-795w?
3 open source packages ship an affected version, including inventory.
| Package | Affected | Fixed in |
|---|---|---|
inventory crates.io | All versions | 0.2.0 |
inventory crates.io | All versions | 0.2.0 |
inventory crates.io | From 0.0.0-0 | 0.2.0 |
How do I fix GHSA-36xm-35qq-795w?
Upgrade inventory to 0.2.0 or later.
Is GHSA-36xm-35qq-795w being exploited?
There is no known exploitation of GHSA-36xm-35qq-795w in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0058.