CVE-2020-35914

The lock_api crate provides synchronization primitives such as Mutex and RwLock for Rust [1]. In versions prior to 0.4.2, the RwLockWriteGuard type had incorrect Send and Sync trait bounds, allowing the guard to be sent across threads even when the inner type was not Send or Sync. This unsoundness violates Rust's memory safety guarantees and can lead to data races [2].

To exploit this vulnerability, an attacker would need to construct a program that transfers a RwLockWriteGuard containing a non-Send or non-Sync type to another thread. Once on the other thread, the guard could be used to access the inner data without proper synchronization, resulting in concurrent reads and writes that are not properly ordered [2].

The impact of this unsoundness is a data race, which in Rust can cause undefined behavior, memory corruption, or crashes. The RustSec advisory classifies this as an unsoundness issue with potential for memory corruption [2].

The issue was addressed in lock_api version 0.4.2 by tightening the Send and Sync bounds on lock guards, as implemented in pull request #262 [4]. Users are advised to update to lock_api 0.4.2 or later to mitigate the vulnerability.