CVE-2020-36218: 
Rust vulnerability analysis and mitigation

An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider (!Send|!Sync) objects, leading to a data race. The vulnerability was discovered on December 18, 2020 and disclosed on January 20, 2021. This vulnerability affects the buttplug crate package available on crates.io (RustSec Advisory).

The vulnerability stems from ButtplugFutureStateShared implementing Send & Sync traits regardless of the generic type T. When T is not Send-compatible (e.g., T=Rc), it becomes possible to move non-Send types across thread boundaries. Similarly, when T is not Sync-compatible (e.g., T=Arc), it can lead to data races. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

The vulnerability can lead to undefined behavior in two scenarios: 1) When T is not Send-compatible, it allows moving non-Send types across thread boundaries, and 2) When T is not Sync-compatible, it can cause data races. This primarily affects the availability of the system, as indicated by the CVSS metrics showing high impact on availability but no impact on confidentiality or integrity (RustSec Advisory).

The vulnerability requires network access but has high attack complexity. No privileges or user interaction is required to exploit the vulnerability. The scope is unchanged, meaning the impact is limited to the vulnerable component's security scope (RustSec Advisory).

The vulnerability was fixed in version 1.0.4 of the buttplug crate by removing manual implementations of Send/Sync for ButtplugFutureStateShared. This allows the Rust compiler (rustc) to automatically generate trait implementations with correct bounds on type T. Users should upgrade to version 1.0.4 or later to address this vulnerability (RustSec Advisory).