CVE-2021-28037: 
Rust vulnerability analysis and mitigation

An issue was discovered in the internment crate before version 0.4.2 for Rust. The vulnerability (CVE-2021-28037) involves a data race condition that can cause memory corruption due to the unconditional implementation of Sync for Intern. The issue was discovered and reported on March 3, 2021, and a fix was issued on March 4, 2021 (RustSec Advisory).

The vulnerability stems from the unconditional implementation of Sync for Intern in the internment crate. This implementation allows users to create a data race on T: !Sync, which can lead to undefined behavior, including memory corruption. The issue has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (NVD).

The vulnerability can lead to memory corruption and undefined behavior in applications using the affected versions of the internment crate. The critical CVSS score indicates potential for severe impacts on system security and stability (RustSec Advisory).

The vulnerability has low attack complexity and requires no privileges or user interaction to exploit. It can be triggered through network access, as indicated by the CVSS vector string (NVD).

The vulnerability was fixed in version 0.4.2 of the internment crate by adding the trait bound T: Sync in the Sync impl of Intern. The fix was implemented in commit 2928a87. Users are advised to upgrade to version 0.4.2 or later (RustSec Advisory).