CVE-2020-35928: 
Rust vulnerability analysis and mitigation

An issue was discovered in the concread crate before 0.2.6 for Rust. The vulnerability (CVE-2020-35928) involves unconditional implementation of Send/Sync traits for ARCache type, which could lead to data races. The issue was disclosed on November 13, 2020 and affects the concread crate versions prior to 0.2.6 (RustSec Advisory).

The vulnerability stems from the ARCache type implementation that unconditionally implemented Send/Sync traits without proper bounds checking. This allows users to send/access types that do not implement Send/Sync, potentially causing data race conditions. The CVSS v3.1 score is 4.7 (Medium) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory, NVD).

The vulnerability could allow attackers to cause data races by sending types that do not implement Send/Sync traits. This primarily affects the availability of the system, with no direct impact on confidentiality or integrity (RustSec Advisory).

The vulnerability requires local access with low privileges and high attack complexity to exploit. No user interaction is needed for exploitation, though the attacker must have the ability to execute code that uses the affected ARCache implementation (RustSec Advisory).

The vulnerability was fixed in version 0.2.6 of the concread crate by adding bounds K: Send + Sync & V: Send + Sync to affected Send/Sync trait implementations. Users should upgrade to version 0.2.6 or later to address this vulnerability (RustSec Advisory).