CVE-2020-36203

Name of the Vulnerable Software and Affected Versions reffers crate through 2020-12-01

Description The issue arises from the ARefss<'a, V> type, which is assumed to contain objects that are Send + Sync. However, in the affected versions, Send/Sync traits are unconditionally implemented for ARefss<'a, V>. This allows the insertion of a !Send or !Sync object into ARefss<'a, V> using the ARefss::map() API. As a result, a data race can be created to the inner object of ARefss<'a, V>, leading to undefined behavior and memory corruption.

Recommendations To resolve the issue, update the reffers crate to a version that includes the fix from commit 6dd7ca0, which adds the trait bound V: Send + Sync to the ARefss::map() API. As a temporary workaround, consider avoiding the use of the ARefss::map() API with objects that are not Send + Sync.