CVE-2020-35897 : An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send

An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race.

Published 2020-12-31 10:15:17

Updated 2021-01-07 15:56:46

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-35897

Atom Project » Atom » For Rust
Versions before (<) 0.3.6
cpe:2.3:a:atom_project:atom:*:*:*:*:*:rust:*:*
Matching versions

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
1.9	LOW	AV:L/AC:M/Au:N/C:N/I:N/A:P	3.4	2.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
4.7	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	1.0	3.6	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Assigned by: nvd@nist.gov (Primary)

https://rustsec.org/advisories/RUSTSEC-2020-0044.html

RUSTSEC-2020-0044: atom: Unsafe Send implementation in Atom allows data races › RustSec Advisory Database
Third Party Advisory

Jump to