CVE-2020-36208

The vulnerability resides in the conquer-once Rust crate, version prior to 0.3.2. The OnceCell type implemented Sync for any T: Sync without requiring T: Send. This allowed a type that is Sync but not Send (e.g., MutexGuard) to be shared across threads, violating Rust's thread safety guarantees. The unsafe impl for Sync missed the Send bound, enabling the creation of concurrent access patterns that are undefined behavior [1][2].

Exploitation requires an attacker to control the initialization of a OnceCell with a non-Send type. In a multi-threaded context, the attacker can cause the non-Send value to be accessed or dropped from a different thread than the one that initialized it. The provided proof of concept demonstrates smuggling a MutexGuard across threads, leading to an attempt to unlock a mutex from a thread that did not lock it [3]. This requires local access and low privileges (CVSS 7.8) [2].

The impact is memory corruption and potential undefined behavior, which can lead to a crash, data corruption, or arbitrary code execution under favorable conditions. The Rust advisory classifies this as a memory corruption and thread safety issue [2].

The issue was fixed in version 0.3.2 by adding a Send bound to the Sync implementation. Users should update to >=0.3.2. No workarounds other than upgrading are documented [2][3].