CVE-2020-36448: Data races in cache
8.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.64009%
CWE
Published
8/25/2021
Updated
2/1/2023
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
cache | rust | <= 0.2.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from improper trait implementations rather than specific functions. The Cache<K>
struct unconditionally implements Send/Sync traits without requiring K
to be Send/Sync. This allows non-thread-safe types (e.g., Rc<T>
, Cell<T>
) to be used in multi-threaded contexts, causing data races. The root cause is the unsafe unsafe impl<K> Send for Cache<K> {}
and unsafe impl<K> Sync for Cache<K> {}
implementations, which lack trait bounds on K
. Since these are trait implementations rather than discrete functions, no specific functions are identified as vulnerable.