CVE-2020-36206: 
Rust vulnerability analysis and mitigation

An issue was discovered in the rusb crate before 0.7.0 for Rust. The vulnerability stems from a lack of Send and Sync bounds in the UsbContext trait implementation, which could lead to data races and memory corruption when used across threads (Rust Advisory). The vulnerability was discovered and reported on December 18, 2020, and was officially issued on January 18, 2021.

The vulnerability exists because the UsbContext trait did not require implementers to be Send and Sync. Through Device and DeviceHandle components, it became possible to use UsbContexts across threads. This design flaw allowed non-thread safe UsbContext types to be used concurrently. The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (HIGH) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Rust Advisory).

The vulnerability can lead to data races and memory corruption when non-thread safe UsbContext types are used concurrently. This could potentially compromise the integrity and reliability of applications using the affected versions of the rusb crate (Rust Advisory).

The vulnerability requires local access and high attack complexity. While user interaction is not needed for exploitation, the attacker needs low-level privileges to execute the attack. The attack vector is local, indicating that the attacker needs to have access to the system running the vulnerable code (Rust Advisory).

The issue has been fixed in version 0.7.0 of the rusb crate by adding Send and Sync bounds to the UsbContext trait. Users are advised to upgrade to version 0.7.0 or later to address this vulnerability (Rust Advisory).