RUSTSEC-2020-0116: 
Rust vulnerability analysis and mitigation

A security vulnerability was discovered in the unicycle crate before version 0.7.1 for Rust. The issue involves PinSlab and Unordered types implementing Send and Sync traits without proper bounds on their contained types, which could lead to data races in safe Rust code (RustSec Advisory, NVD).

The vulnerability stems from unsafe implementations of Send and Sync traits for PinSlab and Unordered types without proper bounds on their contained types. This implementation allows these types to be shared across thread boundaries regardless of whether the contained types themselves are thread-safe. The issue was assigned CVSS v3.1 Base Score of 8.1 (HIGH) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could lead to data races from safe Rust code when using PinSlab or Unordered types across thread boundaries. A proof-of-concept demonstrated how this could result in memory safety violations and potential segmentation faults when sharing non-thread-safe types like Cell across threads (GitHub Issue).

The vulnerability can be exploited through safe Rust code by sharing non-thread-safe types across threads using PinSlab or Unordered containers. A proof-of-concept exploit demonstrated successful exploitation leading to memory corruption and segmentation faults (GitHub Issue).

The vulnerability was fixed in version 0.7.1 of the unicycle crate by adding proper bounds on Send and Sync trait implementations. Users should upgrade to version 0.7.1 or later to receive the fix (NVD).