RUSTSEC-2020-0136: 
Rust vulnerability analysis and mitigation

A security vulnerability (RUSTSEC-2020-0136/CVE-2020-36456) was discovered in the toolshed crate for Rust, affecting versions through 2020-11-15. The issue involves the CopyCell implementation, where the Send trait lacks proper bounds on the contained type, potentially leading to unsafe concurrent operations (RustSec Advisory).

The vulnerability stems from CopyCell implementing Send for any type that implements Copy, without proper bounds checking. This becomes problematic because non-mutable references implement the Copy trait, allowing for potential sharing of non-thread-safe types across threads. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability enables the sharing of non-thread-safe types (such as Cell) across multiple threads, which can lead to data races and undefined behavior in concurrent programs. This breaks Rust's thread safety guarantees and could potentially result in memory corruption or other concurrent access issues (GitHub Issue).

A proof-of-concept exploit has been demonstrated showing how the vulnerability can be triggered using simple Rust code. The exploit involves wrapping a Cell (a non-thread-safe type) in a CopyCell and accessing it from multiple threads, effectively bypassing Rust's thread safety mechanisms (GitHub Issue).

Users should upgrade to a version newer than 2020-11-15 where the vulnerability has been addressed. If upgrading is not immediately possible, users should avoid using CopyCell with reference types or any other types that implement Copy but are not intended to be shared across threads (RustSec Advisory).