playxe/cgc · Security

Non-atomic writes in cgc

GHSA ID
GHSA-pwhf-7427-9vv2
CVE ID
CVE-2020-36468
Severity
medium
Published
Updated
CVSS
5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3
5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Multiple soundness issues in Ptr in cgc

Affected versions of this crate have the following issues:

  1. Ptr implements Send and Sync for all types, this can lead to data races by sending non-thread safe types across threads.

  2. Ptr::get violates mutable alias rules by returning multiple mutable references to the same object.

  3. Ptr::write uses non-atomic writes to the underlying pointer. This means that when used across threads it can lead to data races.

CWEs

References