RUSTSEC-2020-0088: 
Rust vulnerability analysis and mitigation

The magnetic crate before version 2.0.1 for Rust contained a soundness/memory safety issue where MPMCConsumer and MPMCProducer allowed cross-thread sending of non-Send types. The vulnerability was discovered and reported by the Rust group at Georgia Tech (sslab-gatech) on November 29, 2020 (RUSTSEC Advisory).

The vulnerability stemmed from the unsafe implementation of Send and Sync traits for producer/consumer types without a proper Send bound on the generic type T. The implementation allowed users to send non-Send objects across threads, which could lead to data races and undefined behavior. This was particularly problematic with types like Rc that are not thread-safe (RUSTSEC Advisory).

When exploited, this vulnerability could lead to data races, program crashes (with "Illegal Instruction" errors), memory leaks, or other undefined behaviors. The issue was particularly concerning when used with reference-counted types like Rc, where concurrent access could corrupt the reference count (RUSTSEC Advisory).

A proof-of-concept exploit was demonstrated using the MPMC queue with an Rc type, showing how the vulnerability could be triggered in approximately 2 million iterations. The exploit resulted in either program crashes or memory leaks due to unsynchronized reference counting operations (GitHub Issue).

The issue was fixed in version 2.0.1 of the magnetic crate by adding proper Send bounds on the generic type T for both Send and Sync implementations of producer/consumer types. Users should upgrade to version 2.0.1 or later to prevent potential undefined behavior (RUSTSEC Advisory).