richard-w/late-static · Security
Data races in late-static
- GHSA ID
- GHSA-wr55-mf5c-hhwm
- CVE ID
- CVE-2020-36209
- Severity
- high
- Published
- Updated
- CVSS
- 7 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Affected versions of this crate implemented Sync for LateStatic with T: Send, so that it is possible to create a data race to a type T: Send + !Sync (e.g. Cell).
This can result in a memory corruption or other kinds of undefined behavior.
The flaw was corrected in commit 11f396c by replacing the T: Send bound to T: Sync bound in the Sync impl for LateStatic.
CWEs
- CWE-662 · Improper Synchronization