Race condition in try-mutex crate for Rust



Published: 2020-12-21
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID N/A
CWE-ID CWE-362
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		try-mutex
Universal components / Libraries / Programming Languages & Components

Vendor Mike Pedersen

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Race condition

EUVDB-ID: #VU49110

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows an attacker to escalate privileges within the application.

The vulnerability exists due to unconditional implementation of Sync trait for TryMutex type. An attacker can exploit the race to put non-Send T type in TryMutex and send it to another thread.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

try-mutex: 0.1.0 - 0.2.0

External links

http://rustsec.org/advisories/RUSTSEC-2020-0087.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###