Miggo Logo

CVE-2020-36207: Data races in aovec

7

CVSS Score
3.1

Basic Information

EPSS Score
0.21259%
Published
8/25/2021
Updated
1/9/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
aovecrust<= 1.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from Aovec<T> improperly implementing Send and Sync traits without requiring T to implement these traits. In Rust, Send/Sync implementations should only be allowed when the contained type T also satisfies these traits. By unconditionally implementing them, Aovec<T> enables thread-unsafe types (e.g., Rc, Cell) to be used in concurrent contexts, violating Rust's safety guarantees and leading to data races. The root cause is the unsafe trait implementations rather than specific functions, but these trait definitions represent the critical vulnerability points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in t** *ov** *r*t* t*rou** ****-**-** *or Rust. ****us* *ov**<T> *o*s not **v* *oun*s on its S*n* tr*it or Syn* tr*it, * **t* r*** *n* m*mory *orruption **n o**ur.

Reasoning

T** vuln*r**ility st*ms *rom *ov**<T> improp*rly impl*m*ntin* S*n* *n* Syn* tr*its wit*out r*quirin* T to impl*m*nt t**s* tr*its. In Rust, S*n*/Syn* impl*m*nt*tions s*oul* only ** *llow** w**n t** *ont*in** typ* T *lso s*tis*i*s t**s* tr*its. *y un*o