CVE-2020-36206

High

An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory…

mitre·CWE-662·Published 2021-01-22

CVSS

7.0

EPSS

0.00

KEV

Exploits

cve.orgen

152 chars

An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.

NVDen

152 chars

An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.

Affected versions of `rusb` did not require `UsbContext` to implement `Send` and `Sync`. However, through `Device` and `DeviceHandle` it is possible to use `UsbContext`s across threads. This issue allows non-thread safe `UsbContext` types to be used concurrently leading to data races and memory corruption. The issue was fixed by adding `Send` and `Sync` bounds to `UsbContext`.

GHSAen

357 chars

Affected versions of rusb did not require UsbContext to implement Send and Sync. However, through Device and DeviceHandle it is possible to use UsbContexts across threads. This issue allows non-thread safe UsbContext types to be used concurrently leading to data races and memory corruption. The issue was fixed by adding Send and Sync bounds to UsbContext.

NVDes

192 chars

Se detectó un problema en la crate rusb versiones anteriores a 0.7.0 para Rust. Debido a una falta de límites de Send y Sync, una carrera de datos y corrupción de la memoria puede ocurrir

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	4.4	3.4	6.4	AV:L/AC:M/Au:N/C:P/I:P/A:P
3.1	Primary	NVD	7.0	1.0	5.9	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	GHSA	7.0	—	—	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H