RUSTSEC-2020-0134: 
Rust vulnerability analysis and mitigation

An issue was discovered in the parc crate through 2020-11-14 for Rust, identified as RUSTSEC-2020-0134 (CVE-2020-36454). The vulnerability involves the LockWeak implementation, which had an unconditional implementation of Send without trait bounds on T, potentially leading to unsafe concurrent access (RustSec Advisory).

The vulnerability stems from the LockWeak structure having an unsafe implementation of the Send trait without proper trait bounds on the generic type T. This implementation allowed the creation of data races by enclosing a non-Sync type data to ParentArc and accessing the enclosed data from multiple threads via ChildArc. The issue has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD Database).

The vulnerability could lead to undefined behavior in safe Rust code. When exploited, it could result in data races, memory leaks, or program crashes. In proof-of-concept demonstrations, the issue could manifest in various ways including program panics, memory leaks with strong_count > 1, or premature dropping of Rc while references were still active (GitHub PR).

The vulnerability can be triggered using safe Rust code, making it particularly concerning. A proof of concept demonstrated that the issue could be exploited by creating multiple threads accessing non-Sync type data concurrently, leading to undefined behavior particularly noticeable in Debug mode (GitHub PR).

The issue was fixed by adding a Sync bound to the Send implementation of LockWeak, preventing concurrent access to the underlying data from multiple threads. The fix ensures that only types that implement both Send and Sync can be safely shared between threads (GitHub PR).

The vulnerability was discovered by the Rust group at Georgia Tech (@sslab-gatech) during a scan of crates.io. The issue was subsequently included in the RustSec advisory database and is now detected by security tools such as cargo-audit and cargo-deny (GitHub PR).