CVE-2020-35912

Vulnerability

Overview

The lock_api crate, part of the parking_lot ecosystem, provides efficient synchronization primitives for Rust. In versions prior to 0.4.2, the MappedRwLockWriteGuard type had incorrect Send and Sync trait bounds, leading to unsoundness that could cause data races [1][2]. This flaw violates Rust's memory safety guarantees in concurrent contexts.

Exploitation

Conditions

Exploitation requires a scenario where a MappedRwLockWriteGuard is moved across threads without proper synchronization. The incorrect bounds allow the guard to be sent to another thread while the underlying lock is still held, enabling concurrent unsynchronized access to the protected data [2][4]. This is a type-system logic error rather than a runtime exploit, but it can be triggered by any code that relies on the guard's thread-safety properties.

Impact

An attacker who can influence the use of MappedRwLockWriteGuard in a multi-threaded application may cause data races, leading to memory corruption, undefined behavior, and potential security vulnerabilities such as information disclosure or denial of service [2]. The issue is classified as an unsoundness with memory-corruption and thread-safety implications.

Mitigation

The vulnerability is fixed in lock_api version 0.4.2, released in November 2020. Users should update to this version or later. The fix, implemented in pull request #262, adjusts the Send and Sync bounds for lock guards to enforce correct thread-safety constraints [4]. No workarounds are available; updating is the recommended action.