Vulnerability-Lookup

rustsec-2020-0118

Vulnerability from osv_rustsec

Published

2020-12-08 12:00

Modified

2023-06-13 13:10

Summary

Future<T> lacks bounds on Send and Sync.

Details

tiny_future contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits.

This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs.

The flaw was corrected in commit c791919 by adding trait bounds to Future's Send and Sync.

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-corruption",
          "thread-safety"
        ],
        "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "tiny_future",
        "purl": "pkg:cargo/tiny_future"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2020-36438",
    "GHSA-fg42-vwxx-xx5j",
    "GHSA-m296-j53x-xv95"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "`tiny_future` contains a light-weight implementation of `Future`s. The `Future`\ntype it has lacked bound on its `Send` and `Sync` traits.\n\nThis allows for a bug where non-thread safe types such as `Cell` can be used in\n`Future`s and cause data races in concurrent programs.\n\nThe flaw was corrected in commit `c791919` by adding trait bounds to `Future`\u0027s\n`Send` and `Sync`.",
  "id": "RUSTSEC-2020-0118",
  "modified": "2023-06-13T13:10:24Z",
  "published": "2020-12-08T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/tiny_future"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2020-0118.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/KizzyCode/tiny_future/issues/1"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Future\u003cT\u003e lacks bounds on Send and Sync."
}

CVE-2020-36438 (GCVE-0-2020-36438)

Vulnerability from cvelistv5 – Published: 2021-08-08 05:18 – Updated: 2024-08-04 17:30

Summary

An issue was discovered in the tiny_future crate before 0.4.0 for Rust. Future<T> does not have bounds on its Send and Sync traits.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://rustsec.org/advisories/RUSTSEC-2020-0118.html	x_refsource_MISC
	https://raw.githubusercontent.com/rustsec/advisor…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:30:08.259Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2020-0118.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the tiny_future crate before 0.4.0 for Rust. Future\u003cT\u003e does not have bounds on its Send and Sync traits."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-08T05:18:32",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2020-0118.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-36438",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in the tiny_future crate before 0.4.0 for Rust. Future\u003cT\u003e does not have bounds on its Send and Sync traits."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://rustsec.org/advisories/RUSTSEC-2020-0118.html",
              "refsource": "MISC",
              "url": "https://rustsec.org/advisories/RUSTSEC-2020-0118.html"
            },
            {
              "name": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md",
              "refsource": "MISC",
              "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-36438",
    "datePublished": "2021-08-08T05:18:32",
    "dateReserved": "2021-08-08T00:00:00",
    "dateUpdated": "2024-08-04T17:30:08.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-FG42-VWXX-XX5J

Vulnerability from github – Published: 2021-08-25 20:58 – Updated: 2023-06-13 22:05

Summary

Data race in tiny_future

Details

tiny_future contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit c791919 by adding trait bounds to Future's Send and Sync.

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "tiny_future"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-36438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-09T22:41:30Z",
    "nvd_published_at": "2021-08-08T06:15:00Z",
    "severity": "HIGH"
  },
  "details": "tiny_future contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit `c791919` by adding trait bounds to Future\u0027s Send and Sync.",
  "id": "GHSA-fg42-vwxx-xx5j",
  "modified": "2023-06-13T22:05:30Z",
  "published": "2021-08-25T20:58:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KizzyCode/tiny_future/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KizzyCode/tiny_future-rust/commit/c7919199a0f6d1ce0e3c33499d1b37f862c990e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/KizzyCode/tiny_future"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tiny_future/RUSTSEC-2020-0118.md"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2020-0118.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Data race in tiny_future"
}

GHSA-M296-J53X-XV95

Vulnerability from github – Published: 2021-08-25 21:00 – Updated: 2023-06-13 21:47

Summary

Data races in tiny_future

Details

tiny_future contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit c791919 by adding trait bounds to Future's Send and Sync.

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "tiny_future"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-05T22:01:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "`tiny_future` contains a light-weight implementation of `Future`s. The `Future` type it has lacked bound on its `Send` and `Sync` traits. This allows for a bug where non-thread safe types such as `Cell` can be used in `Future`s and cause data races in concurrent programs. The flaw was corrected in commit `c791919` by adding trait bounds to `Future`\u0027s `Send` and `Sync`.\n",
  "id": "GHSA-m296-j53x-xv95",
  "modified": "2023-06-13T21:47:59Z",
  "published": "2021-08-25T21:00:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/KizzyCode/tiny_future/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KizzyCode/tiny_future/commit/7ab8a264980d23c2ed64e72f4636f38b7381eb39"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KizzyCode/tiny_future/commit/c7919199a0f6d1ce0e3c33499d1b37f862c990e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/KizzyCode/tiny_future"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2020-0118.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Data races in tiny_future"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

rustsec-2020-0118

Vulnerability from osv_rustsec

CVE-2020-36438 (GCVE-0-2020-36438)

GHSA-FG42-VWXX-XX5J

GHSA-M296-J53X-XV95

Tags

Sightings

Nomenclature