GHSA-jh2g-xhqq-x4w9: Send/Sync bound needed on T for Send/Sync impl of RcuCell<T>

August 25, 2021

Affected versions of this crate unconditionally implement Send/Sync for RcuCell<T>. This allows users to send T: !Send to other threads (while T enclosed within RcuCell<T>), and allows users to concurrently access T: !Sync by using the APIs of RcuCell<T> that provide access to &T.

This can result in memory corruption caused by data races.

References

github.com/Xudong-Huang/rcu_cell
github.com/Xudong-Huang/rcu_cell/issues/3
github.com/Xudong-Huang/rcu_cell/pull/4/commits/1faf18eee11f14969b77ae0f76dcd9ebd437d0c2
github.com/advisories/GHSA-jh2g-xhqq-x4w9
rustsec.org/advisories/RUSTSEC-2020-0131.html

Detect and mitigate GHSA-jh2g-xhqq-x4w9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →