RUSTSEC-2020-0070: 
Rust vulnerability analysis and mitigation

The vulnerability RUSTSEC-2020-0070 affects the lock_api crate versions before 0.4.2 for Rust. This security issue involves multiple lock guard objects that can potentially cause data races due to unsoundness in their implementation. The vulnerability was discovered and disclosed in late 2020, affecting the core synchronization primitives in the Rust ecosystem (NVD).

The vulnerability encompasses multiple CVEs (CVE-2020-35913, CVE-2020-35912, CVE-2020-35910) related to data races in different guard implementations. The issues specifically affect RwLockReadGuard, MappedRwLockWriteGuard, and MappedMutexGuard implementations. The CVSS v3.1 scores range from 4.7 to 5.5 (Medium severity), with vectors indicating local access requirements and high availability impact (NVD).

The vulnerability could lead to data races in concurrent applications using these lock guards, potentially causing memory corruption, program crashes, or undefined behavior. The primary impact is on application availability and data integrity, particularly in multi-threaded environments (NVD).

The vulnerability requires local access and specific conditions to exploit. It primarily affects applications using the lock_api crate's synchronization primitives in concurrent scenarios. The complexity of exploitation is considered high, as indicated by the CVSS metrics (NVD).

The vulnerability was fixed in lock_api version 0.4.2. Users should upgrade to this version or later to mitigate the issue. The fix involves correcting the bounds on Send and Sync implementations for lock guards (GitHub PR).

The vulnerability was formally verified by security researchers, who confirmed the soundness of the fix. Notably, researchers Jacques-Henri Jourdan and Ralf Jung provided formal proof verification of the security implications and the correctness of the implemented fixes (GitHub PR).