CVE-2020-35925: 
Rust vulnerability analysis and mitigation

An issue was discovered in the magnetic crate before version 2.0.1 for Rust, identified as CVE-2020-35925. The vulnerability was reported on November 29, 2020, and officially issued on December 7, 2020. The vulnerability affects the MPMCConsumer and MPMCProducer components of the magnetic crate, which incorrectly allow cross-thread sending of non-Send type data (RustSec Advisory).

The vulnerability stems from the unconditional implementation of Sync and Send traits for MPMCConsumer and MPMCProducer types without proper type bounds. This implementation oversight allows for the transmission of types that don't implement the Send trait across thread boundaries, potentially causing data races. The vulnerability has been assigned a CVSS v3.1 score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

The primary impact of this vulnerability is the potential for data races when non-Send types are transmitted across thread boundaries. This can lead to high availability impacts in affected systems, though there are no direct impacts on confidentiality or integrity (RustSec Advisory).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is needed to exploit the vulnerability, making it relatively straightforward to trigger in affected systems (RustSec Advisory).

The vulnerability was fixed in version 2.0.1 of the magnetic crate by adding T: Send bound to affected Sync/Send trait implementations. Users are advised to upgrade to version 2.0.1 or later to address this security issue (RustSec Advisory).