# GHSA-w59h-378f-2frm: Unsound sending of non-Send types across threads in threadalone

> The threadalone crate may drop non-Send types on the wrong thread, causing undefined behavior and potential crashes or code execution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 7 Jan 2024
- **Also known as:** RUSTSEC-2024-0005

## What is GHSA-w59h-378f-2frm?

GHSA-w59h-378f-2frm is a vulnerability in threadalone, published on 7 Jan 2024. 

### Official description

Affected versions can run the `Drop` impl of a non-Send type on a different
thread than it was created on.

The flaw occurs when a stderr write performed by the `threadalone` crate fails,
for example because stderr is redirected to a location on a filesystem that is
full, or because stderr is a pipe that has been closed by the reader.

Dropping a non-Send type on the wrong thread is unsound. If used with a type
such as a pthread-based `MutexGuard`, [the consequence is undefined
behavior][mutexguard]. If used with `Rc`, there would be a data race on the
reference count, which is likewise undefined behavior.

[mutexguard]: https://github.com/rust-lang/rust/issues/23465#issuecomment-82730326

## Which versions are affected by GHSA-w59h-378f-2frm?

3 open source packages ship an affected version, including threadalone.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `threadalone` | crates.io | All versions | 0.2.1 |
| `threadalone` | crates.io | All versions | 0.2.1 |
| `threadalone` | crates.io | From 0.0.0-0 | 0.2.1 |

## How do I fix GHSA-w59h-378f-2frm?

Upgrade threadalone to 0.2.1 or later.

## Is GHSA-w59h-378f-2frm being exploited?

There is no known exploitation of GHSA-w59h-378f-2frm in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-w59h-378f-2frm and fix it if it is affected.

What it is: GHSA-w59h-378f-2frm is a vulnerability in threadalone, published on 7 Jan 2024. 
Exploitation: There is no known exploitation of GHSA-w59h-378f-2frm in the wild and no public exploit code.

Affected packages and fixed versions:
- threadalone (crates.io): affected all versions; fixed in 0.2.1
- threadalone (crates.io): affected all versions; fixed in 0.2.1
- threadalone (crates.io): affected from 0.0.0-0; fixed in 0.2.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-w59h-378f-2frm/ (Markdown: https://insights.sbomify.com/GHSA-w59h-378f-2frm/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-w59h-378f-2frm

---
From sbomify Insights: https://insights.sbomify.com/GHSA-w59h-378f-2frm/
Summaries are generated and may contain mistakes; the official description above is the record.