CVE-2020-36447: 
Rust vulnerability analysis and mitigation

An issue was discovered in the v9 crate through 2020-12-18 for Rust. The vulnerability involves an unconditional implementation of Sync for SyncRef, which allows data races when &T is accessible through &SyncRef. This vulnerability is tracked as CVE-2020-36447 (RUSTSEC Advisory).

The vulnerability stems from SyncRef deriving Clone and Debug traits, where the default implementations access &T by invoking T::clone() and T::fmt(). This implementation creates potential data races and undefined behavior when SyncRef::clone() or SyncRef::fmt() are concurrently invoked from multiple threads with T: !Sync. The vulnerability has a CVSS score of 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (RUSTSEC Advisory).

The vulnerability can lead to memory corruption and thread-safety issues, potentially compromising the confidentiality, integrity, and availability of affected systems. The impact is particularly severe as it can result in undefined behavior through data races (RUSTSEC Advisory).

The vulnerability has been patched in version 0.1.43 and later versions of the v9 crate (RUSTSEC Advisory).