CVE-2020-36445: 
Rust vulnerability analysis and mitigation

An issue was discovered in the convec crate through 2020-11-24 for Rust, involving unconditional implementations of Send and Sync for ConVec. The vulnerability was assigned CVE-2020-36445 and was reported on November 24, 2020. This vulnerability affects all versions of the convec crate up to and including the last release on November 24, 2020 (RustSec Advisory).

The vulnerability stems from the unconditional implementation of Send and Sync traits for ConVec<T>, without proper constraints on the type parameter T. This implementation allows users to insert types that are not Send or not Sync into ConVec. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (RustSec Advisory).

The vulnerability enables the creation of data races in two ways: by using non-Send types like Arc> or Rc<> as T in ConVec, or by using types like Cell<> or RefCell<_> as T (types that are Send but not Sync). These data races can lead to memory corruption (RustSec Advisory).

The vulnerability requires high attack complexity but can be exploited without requiring privileges or user interaction. The attack can be initiated remotely through network access (RustSec Advisory).

As of the last available information, there are no patched versions available for this vulnerability (RustSec Advisory).