CVE-2021-45704

Name of the Vulnerable Software and Affected Versions: metrics-util crate versions prior to 0.7.0

Description: The issue is related to a data race and memory corruption in the AtomicBucket<T> implementation. This occurs because AtomicBucket<T> unconditionally implements the Send and Sync traits, allowing users to create a data race to the inner T: !Sync by using the AtomicBucket::data with() API. Such data races can potentially cause memory corruption or other undefined behavior.

Recommendations: For versions prior to 0.7.0, update to version 0.7.0 or later to fix the issue by adding appropriate Send/Sync bounds to the Send/Sync impl of struct Block<T>. As a temporary workaround, consider avoiding the use of the AtomicBucket::data with() API to minimize the risk of exploitation.