CVE-2020-36436: 
Rust vulnerability analysis and mitigation

An issue was discovered in the unicycle crate before 0.7.1 for Rust where the crate unconditionally implemented Send & Sync traits for types PinSlab & Unordered. The vulnerability was discovered on November 15, 2020 and was assigned CVE-2020-36436 (RustSec Advisory).

The vulnerability stems from the unconditional implementation of Send & Sync traits for PinSlab & Unordered types without proper trait bounds. This implementation allowed sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads. The issue has a CVSS score of 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (RustSec Advisory).

This vulnerability can result in data races and memory corruption when types that provide internal mutability without synchronization are contained within PinSlab or Unordered and accessed concurrently from multiple threads (RustSec Advisory).

The vulnerability was fixed in version 0.7.1 of the unicycle crate. The fix involved adding trait bound T: Send to Send implementations for PinSlab & Unordered and adding T: Sync to Sync implementations for PinSlab & Unordered. The patches were implemented in commits 92f40b4 & 6a6c367 (RustSec Advisory).