RUSTSEC-2020-0130: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2020-0130/CVE-2020-36450) was discovered in the bunch crate for Rust through version 2020-11-12. The issue involves unconditional implementations of Send and Sync traits for the Bunch type without proper bounds, which could lead to undefined behavior in multi-threaded contexts (RustSec Advisory).

The vulnerability stems from an unsafe implementation of the Sync trait for the Bunch type without requiring a Sync bound on the generic type parameter T. This implementation allows for potential data races when Bunch is used across multiple threads. The severity is rated as HIGH with a CVSS 3.1 Base Score of 8.1 (Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability can lead to undefined behavior and potential segmentation faults when the Bunch type is used in multi-threaded applications. This is particularly dangerous when dealing with types that are not thread-safe, such as Cell<T>, as demonstrated in the proof-of-concept code (GitHub Issue).

A proof-of-concept exploit has been demonstrated showing how the vulnerability can be triggered using non-thread-safe types like Cell<T> in a multi-threaded context, resulting in data races and segmentation faults (GitHub Issue).

The recommended fix is to add a T: Sync bound to the unsafe impl Sync for Bunch implementation, ensuring that the contained type T is thread-safe before allowing Bunch<T> to be Sync (GitHub Issue).