RUSTSEC-2020-0096: 
Rust vulnerability analysis and mitigation

The RUSTSEC-2020-0096 vulnerability was discovered in the im crate through 2020-11-09 for Rust. The issue involves the TreeFocus type lacking proper bounds on its Send trait and Sync trait, which could potentially lead to data races. The vulnerability was reported by researchers from the Rust group at SSLAB Georgia Tech (SSLAB Issue).

The vulnerability exists in the TreeFocus implementation for RRB-tree backed vectors. The TreeFocus type was implemented with unsafe Send and Sync trait bounds without proper restrictions, allowing it to be shared across thread boundaries unsafely. This implementation oversight could allow safe Rust code to cause data races by sharing mutable references across threads (SSLAB Issue).

The vulnerability could lead to data races in multithreaded applications using the im crate's vector implementation. While TreeFocus is an implementation detail not meant for end-users, the issue could still be exploited through safe Rust code to cause memory safety violations and potential segmentation faults (SSLAB Issue).

A proof-of-concept exploit was demonstrated showing how the vulnerability could be triggered using safe Rust code. The exploit involves creating a large enough vector to promote it to an RRB tree, then using crossbeam_utils to spawn threads that can cause data races by simultaneously accessing shared mutable state (SSLAB Issue).

The vulnerability was fixed by updating the im crate to properly implement bounds on the Send and Sync traits for TreeFocus. Users should upgrade to versions after 2020-11-09 to receive the security fix (SSLAB Issue).