RUSTSEC-2020-0098: 
Rust vulnerability analysis and mitigation

The RUSTSEC-2020-0098 vulnerability was discovered in the rusb crate before version 0.7.0 for Rust. The issue involves improper synchronization due to a lack of Send and Sync bounds, which could lead to data races and memory corruption. The vulnerability was assigned CVE-2020-36206 and was disclosed in January 2021 (NVD).

The vulnerability stems from the Device and DeviceHandle types implementing Send and Sync traits without proper bounds on the UsbContext trait. The UsbContext trait lacked Send and Sync bounds and could be implemented by users, potentially allowing the creation of non-thread safe implementations in safe Rust code. This oversight could result in data races when used with Device or DeviceHandle. The issue was assigned a CVSS v3.1 base score of 7.0 (HIGH) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could lead to data races and memory corruption in applications using the rusb crate. This could potentially result in high impacts on confidentiality, integrity, and availability of affected systems (NVD).

The vulnerability requires local access and high attack complexity to exploit. An attacker would need low privileges but no user interaction to potentially trigger the vulnerability (NVD).

The vulnerability was fixed in version 0.7.0 of the rusb crate. Users should upgrade to this version or later to address the issue. For those unable to upgrade immediately, a potential workaround would be to ensure UsbContext implementations are thread-safe (RUSTSEC Advisory).

The vulnerability was initially discovered by the Rust group at Georgia Tech's Systems Software & Security Lab (SSLab) during a security scan of crates.io. The issue was reported through GitHub's issue tracking system, demonstrating the effectiveness of community-driven security research in the Rust ecosystem (GitHub Issue).