RUSTSEC-2020-0150: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2020-0150/CVE-2020-36470) was discovered in the disrustor crate through December 17, 2020, for Rust programming language. The issue involves the RingBuffer implementation which does not properly limit the number of mutable references, allowing unsafe operations with non-Send types across threads (RustSec Advisory).

The vulnerability stems from the RingBuffer implementation that incorrectly implements Send/Sync traits regardless of whether the internal type implements Send/Sync. This implementation oversight allows users to send a non-Send type across threads with RingBuffer, which can lead to undefined behavior in safe Rust code (GitHub Issue).

The vulnerability could lead to data races and undefined behavior in applications using the disrustor crate. When non-Send types are transmitted across threads, it can result in memory safety violations and potential application crashes (GitHub Issue).

The vulnerability can be exploited through safe Rust code without requiring any unsafe blocks. A proof-of-concept demonstrates that non-Send types can be sent across threads using the RingBuffer implementation, leading to panic when the destructor runs on the wrong thread (GitHub Issue).

The recommended fix involves adding appropriate trait bounds on the internal type T for RingBuffer's Send/Sync implementations, or restricting the RingBuffer's new() constructor with pub(crate) if it's not meant to be created by end users (GitHub Issue).