Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zaHhoLTdqeG0tNTl4NM4AArss

AtomicBucket<T> unconditionally implements Send/Sync

In the affected versions of the crate, AtomicBucket<T> unconditionally implements Send/Sync traits. Therefore, users can create a data race to the inner
T: !Sync by using the AtomicBucket::data_with() API.
Such data races can potentially cause memory corruption or other undefined behavior.

The flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct Block<T> (which is a data type contained inside AtomicBucket<T>).

Permalink: https://github.com/advisories/GHSA-3hxh-7jxm-59x4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zaHhoLTdqeG0tNTl4NM4AArss
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-3hxh-7jxm-59x4
References:

• https://github.com/metrics-rs/metrics/issues/190
• https://rustsec.org/advisories/RUSTSEC-2021-0113.html
• https://github.com/advisories/GHSA-3hxh-7jxm-59x4

Repository: https://github.com/metrics-rs/metrics
Blast Radius: 0.0

Affected Packages