RUSTSEC-2020-0094: 
Rust vulnerability analysis and mitigation

An issue was discovered in the reffers crate through 2020-12-01 for Rust, identified as RUSTSEC-2020-0094 (CVE-2020-36203). The vulnerability allows ARefss to contain a !Send,!Sync object, which can lead to data races and memory corruption in Rust applications (RustSec Advisory).

The vulnerability stems from the ARefss::map() function lacking proper Send + Sync bounds on the V parameter. This oversight in type constraints allows the creation of references that violate Rust's thread safety guarantees. The vulnerability has been assigned a CVSS v3.1 base score of 4.7 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue is classified under CWE-362 (Race Condition) and CWE-787 (Out-of-bounds Write) (NVD Database).

When exploited, this vulnerability can lead to data races and memory corruption, potentially causing segmentation faults in applications using the affected crate. The issue becomes particularly dangerous when the affected code is compiled and run in release mode, where it can result in undefined behavior and process crashes (GitHub Issue).

A proof of concept exploit has been demonstrated that can trigger undefined behavior in safe Rust code. The exploit involves creating a data race condition by manipulating references across threads, eventually leading to segmentation faults when compiled in release mode (GitHub Issue).

The vulnerability affects versions of the reffers crate through 2020-12-01. Users should update to a patched version of the crate or implement proper synchronization mechanisms when dealing with shared resources (RustSec Advisory).