Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2020-35914

CVE-2020-35914:
Data races in lock_api

4.7

CVSS Score

Basic Information

CVE ID
CVE-2020-35914
GHSA ID
GHSA-gmv4-vmx3-x9f3
EPSS Score
-
CWE
CWE-362
Published
8/25/2021
Updated
6/13/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
lock_apirust< 0.4.20.4.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper Send/Sync trait implementations on various guard types. Specifically:

  1. RwLockWriteGuard had unsound Sync implementation allowing concurrent mutable access
  2. Mapped guards lacked proper trait bounds checks for Send/Sync
  3. The Deref implementations enabled access to protected data without proper synchronization guarantees These issues are confirmed by the advisory's mention of 'data races through types not safe to Send' and the linked PR showing trait bound fixes.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in t** lo*k_*pi *r*t* ***or* *.*.* *or Rust. * **t* r*** **n o**ur ****us* o* RwLo*kWrit**u*r* unsoun*n*ss.

Reasoning

T** vuln*r**ility st*ms *rom improp*r S*n*/Syn* tr*it impl*m*nt*tions on v*rious *u*r* typ*s. Sp**i*i**lly: *. RwLo*kWrit**u*r* *** unsoun* Syn* impl*m*nt*tion *llowin* *on*urr*nt mut**l* ****ss *. M*pp** *u*r*s l**k** prop*r tr*it *oun*s ****ks *or