Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJtZmYtZjh3OS1jOXJt

Data races in max7301

The ImmediateIO and TransactionalIO types implement Sync for all contained
Expander<EI> types regardless of if the Expander itself is safe to use
across threads.

As the IO types allow retrieving the Expander, this can lead to non-thread
safe types being sent across threads as part of the Expander leading to data
races.

Permalink: https://github.com/advisories/GHSA-rmff-f8w9-c9rm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJtZmYtZjh3OS1jOXJt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-rmff-f8w9-c9rm, CVE-2020-36472
References:

• https://github.com/edarc/max7301/issues/1
• https://github.com/edarc/max7301/commit/0a1da873ddb29bca926bad8301f8d7ab8aa97c52
• https://nvd.nist.gov/vuln/detail/CVE-2020-36472
• https://rustsec.org/advisories/RUSTSEC-2020-0152.html
• https://github.com/advisories/GHSA-rmff-f8w9-c9rm

Repository: https://github.com/edarc/max7301
Blast Radius: 1.0

Affected Packages