Lucene search

K
rustsecRustsecRUSTSEC-2020-0061
HistoryMay 03, 2020 - 12:00 p.m.

futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer

2020-05-0312:00:00
rustsec.org
8

0.0004 Low

EPSS

Percentile

12.8%

Affected versions of the crate used a UnsafeCell in thread-local storage to return a noop waker reference,
assuming that the reference would never be returned from another thread.

This resulted in a segmentation fault crash if Waker::wake_by_ref() was called on a waker returned from another thread due to
it attempting to dereference a pointer that wasn’t accessible from the main thread.

Reproduction Example (from issue):

use futures_task::noop_waker_ref;
fn main() {
    let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap();
    waker.wake_by_ref();
}

The flaw was corrected by using a OnceCell::Lazy<> wrapper around the noop waker instead of thread-local storage.

CPENameOperatorVersion
futures-tasklt0.3.5

0.0004 Low

EPSS

Percentile

12.8%