RUSTSEC-2020-0111: 
Rust vulnerability analysis and mitigation

RUSTSEC-2020-0111 affects the may_queue crate through version 2020-11-10 for Rust. The vulnerability stems from the Queue implementation lacking proper bounds on its Send trait and Sync trait, which can lead to memory corruption. The issue was discovered and reported on November 10, 2020 (GitHub Issue).

The vulnerability exists because the mpsc_list::Queue and mpsc_list_v1::Queue implementations allow sending types across threads that aren't thread-safe, despite having a guarantee about single-consumer behavior. This can lead to data races when using types like Cell. The issue has been assigned CVSS 3.1 Base Score of 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can result in memory corruption and potential segmentation faults when using the Queue implementation with non-thread-safe types across different threads. This creates undefined behavior and can lead to application crashes or potential memory safety violations (GitHub Issue).

A proof-of-concept exploit has been demonstrated using Cell types to create a data race condition that can result in dereferencing invalid memory addresses and causing segmentation faults. The exploit requires no special privileges but does need the ability to execute code (GitHub Issue).

The vulnerability was fixed in versions after 2020-11-10 by adding proper bounds on the Send and Sync traits for the Queue implementation. Users should upgrade to a patched version of the may_queue crate (NVD).