CVE-2020-35913
Description
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A data race vulnerability in the lock_api Rust crate before 0.4.2 due to unsound RwLockReadGuard Send/Sync implementations can lead to memory corruption and undefined behavior.
Vulnerability
The lock_api crate provides synchronization primitives like RwLock. Versions before 0.4.2 contain an unsoundness issue in the RwLockReadGuard type, where the Send and Sync trait implementations are incorrectly bounded. This can cause a data race when the guard is used across threads without proper synchronization [2].
Exploitation
The unsoundness stems from the fact that the guard can be sent or shared across threads even when the protected data type does not satisfy the necessary thread-safety requirements. The pull request fixing the issue clarifies that T: Send is required for MutexGuard: Send, but for RwLockReadGuard, both T: Send and T: Sync are needed to guarantee safety [4]. An attacker may exploit this by creating a scenario where a non-Send or non-Sync type is used with RwLock, causing data races and undefined behavior through safe code.
Impact
A data race can lead to memory corruption, inconsistent state, and other undefined behavior. This vulnerability is classified as unsound and can compromise the memory safety guarantees of Rust programs using the affected versions [2].
Mitigation
The issue was addressed in lock_api version 0.4.2. Users should update to this version or later. The fix was implemented in pull request #262, which corrects the auto-trait bounds for lock guards [4]. No workaround is available other than avoiding the affected locking primitives.
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
lock_apicrates.io | < 0.4.2 | 0.4.2 |
Affected products
2- Rust/lock_apidescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-hj9h-wrgg-hgmxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-35913ghsaADVISORY
- github.com/Amanieu/parking_lot/pull/262ghsaWEB
- rustsec.org/advisories/RUSTSEC-2020-0070.htmlghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.