RUSTSEC-2020-0101: 
Rust vulnerability analysis and mitigation

The RUSTSEC-2020-0101 (CVE-2020-36208) vulnerability was discovered in the conquer-once crate versions prior to 0.3.2 for Rust. The issue was identified and reported by the Rust group at Georgia Tech (sslab-gatech) on December 23, 2020. This vulnerability allows thread crossing to occur for non-Send but Sync types, which can lead to memory corruption (RustSec Advisory).

The vulnerability stems from an improper implementation of the Sync trait for OnceCell where T has no Send bound. The CVSS v3.1 base score is 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is classified under CWE-787 (Out-of-bounds Write) and CWE-662 (Improper Synchronization). The vulnerability allows for the exploitation of thread boundary crossing with non-Send but Sync types (NVD).

The vulnerability can lead to memory corruption and undefined behavior when a thread attempts to unlock a Mutex that it has not locked. This creates potential security risks in applications using the affected versions of the conquer-once crate (GitHub Issue).

A proof of concept exploit has been demonstrated using std::sync::MutexGuard across thread boundaries. The exploit takes advantage of the fact that MutexGuard is Sync but not Send, allowing it to bypass thread safety mechanisms (GitHub Issue).

The vulnerability has been fixed in version 0.3.2 of the conquer-once crate by adding a Send bound to T in the Sync implementation for OnceCell. The fix prevents the compiler from allowing non-Send types to cross thread boundaries (GitHub Issue).