RUSTSEC-2020-0140: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2020-0140/CVE-2020-36460) was discovered in the Rust 'model' crate, specifically related to unsound implementations of Send and Sync traits for the Shared object. The issue was identified and reported by researchers from the Rust group at Georgia Tech's Systems Software & Security Lab (SSLab) on November 10, 2020 (GitHub Issue).

The vulnerability stems from the Shared object lacking proper bounds on its Send/Sync trait implementations. The unsafe implementations of these traits were found in model/src/lib.rs, where both Sync and Send traits were implemented without appropriate safety constraints. This implementation could lead to undefined behavior and potential data races in safe Rust code (GitHub Issue).

The vulnerability allows creation of data races from safe Rust code, particularly when sharing types like Cell. This could lead to memory safety violations and potential segmentation faults in applications using the affected crate. A proof-of-concept demonstrated the ability to cause segmentation faults through exploitation of this vulnerability (GitHub Issue).

A proof-of-concept exploit was developed demonstrating the vulnerability's exploitability. The exploit shows how the unsound implementation could be used to create data races and cause segmentation faults using only safe Rust code (GitHub Issue).