GHSA-36xm-35qq-795w: Inventory exposes reference to non-Sync data to an arbitrary thread

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. GHSA-36xm-35qq-795w

Inventory exposes reference to non-Sync data to an arbitrary thread

Moderate severity GitHub Reviewed Published Sep 11, 2023 to the GitHub Advisory Database • Updated Sep 11, 2023

Package

cargo inventory (Rust)

Affected versions

< 0.2.0

Description

Affected versions do not enforce a Sync bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them.

A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.

The flaw was corrected by enforcing that data submitted by the caller into inventory is Sync.

References

• dtolnay/inventory#42
• dtolnay/inventory@e1e347d
• https://rustsec.org/advisories/RUSTSEC-2023-0058.html

Published to the GitHub Advisory Database

Sep 11, 2023

Last updated

Sep 11, 2023