CVE-2020-36214: 
Rust vulnerability analysis and mitigation

An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur. The vulnerability was reported on December 19, 2020, and issued on January 20, 2021 (RustSec Advisory).

The vulnerability stems from the unconditional implementation of Send for types used in queue implementations (InnerSend, InnerRecv, FutInnerSend, FutInnerRecv). This allows users to send non-Send types to other threads. The CVSS v3.1 base score is 5.9 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

The vulnerability can lead to data race bugs or other undefined behavior when non-Send types are sent between threads (RustSec Advisory).

The vulnerability requires network access with high attack complexity. No privileges or user interaction is required for exploitation (RustSec Advisory).

The flaw was corrected in version 0.1.7 by adding T: Send bound to the Send implementation of the four affected data types (InnerSend, InnerRecv, FutInnerSend, FutInnerRecv) (RustSec Advisory).