Lucene search

K
githubGitHub Advisory DatabaseGHSA-FQQ2-XP7M-XVM8
HistoryAug 25, 2021 - 8:58 p.m.

Data race in ruspiro-singleton

2021-08-2520:58:19
CWE-119
CWE-362
GitHub Advisory Database
github.com
16
data race
ruspiro-singleton
singleton
sync
send
bug
cell
concurrent programs
trait bounds
software

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

61.8%

Singleton<T> is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that static items must implement Sync,
Singleton implemented both Sync and Send unconditionally.

This allows for a bug where non-Sync types such as Cell can be used in
singletons and cause data races in concurrent programs.

The flaw was corrected in commit b0d2bd20e by adding trait bounds, requiring
the contaiend type to implement Sync.

Affected configurations

Vulners
Node
ruspiro-singleton_projectruspiro-singletonRange<0.4.1rust
VendorProductVersionCPE
ruspiro-singleton_projectruspiro-singleton*cpe:2.3:a:ruspiro-singleton_project:ruspiro-singleton:*:*:*:*:*:rust:*:*

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

61.8%

Related for GHSA-FQQ2-XP7M-XVM8