RUSTSEC-2020-0106: 
Rust vulnerability analysis and mitigation

A memory-safety/soundness issue was discovered in the multiqueue2 crate before version 0.1.7 for Rust. The vulnerability allows non-Send types to be sent to different threads, which can lead to data race conditions. The issue was identified and reported by the Rust group @sslab-gatech while scanning Rust code on crates.io for potential vulnerabilities (RUSTSEC Advisory, NVD).

The vulnerability stems from missing T: Send bounds in the Send implementations for InnerSend, InnerRecv, FutInnerSend, and FutInnerRecv types. This allows queue APIs provided by the crate (except for MPMCSender, MPMCReceiver) to send non-Send types to other threads, which violates Rust's thread safety guarantees. The issue has been assigned CVSS v3.1 Base Score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to data race conditions in safe Rust programs. Proof of concept examples demonstrate how this can cause memory corruption, segmentation faults, and memory leaks when exploited. One example shows a data race to a Cell causing memory corruption, while another example shows a data race to a single Rc causing either segmentation faults or memory leaks (RUSTSEC Advisory).

The vulnerability can be exploited by creating programs that use the affected queue APIs to send non-Send types across threads. Two proof-of-concept examples have been provided demonstrating successful exploitation on Ubuntu 18.04 using rustc 1.49.0-nightly in Debug mode (RUSTSEC Advisory).

The issue has been fixed in version 0.1.7 by adding T: Send bounds to the Send implementations for the affected types. Users should upgrade to version 0.1.7 or later. The fix prevents the compiler from allowing programs to use the queues to send non-Send types to other threads (RUSTSEC Advisory).