CVE-2020-36220: 
Rust vulnerability analysis and mitigation

An issue was discovered in the va-ts crate before 0.0.4 for Rust. The vulnerability (CVE-2020-36220) stems from the Demuxer component omitting a required T: Send bound, which could lead to data race conditions and memory corruption. The issue was disclosed on January 21, 2021 (RustSec Advisory).

The vulnerability exists because Demuxer unconditionally implemented Send with no trait bounds on T. This implementation allows sending a non-Send type T across thread boundaries, which can result in undefined behavior. The severity of this vulnerability is rated as MEDIUM with a CVSS v3.1 base score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) (RustSec Advisory).

The vulnerability can lead to serious consequences including unlocking a mutex from a thread that didn't lock the mutex, and potential memory corruption due to data races. The impact primarily affects the availability of the system, with no direct impact on confidentiality or integrity (RustSec Advisory).

The vulnerability requires network access and has high attack complexity. No privileges or user interaction are required to exploit this vulnerability. However, the technical nature of the flaw makes it challenging to exploit as it requires specific conditions involving thread boundaries and non-Send type handling (RustSec Advisory).

The vulnerability was fixed in va-ts version 0.0.4 by adding a T: Send bound to the Send impl for Demuxer in commit 0562cbf. Users should upgrade to version 0.0.4 or later to address this vulnerability (RustSec Advisory).