CVE-2020-36441

Vulnerability

In the abox crate prior to version 0.4.1, the AtomicBox type incorrectly implements the Send and Sync traits for any T: Sized, without requiring that T itself be Send or Sync [1][2][4]. This means that AtomicBox can be sent across threads or shared between threads even when T does not uphold the safety guarantees of those traits. The flaw is rooted in the missing trait bounds on the generic parameter T in the unsafe impl blocks for Send and Sync [2]. All versions of abox before 0.4.1 are affected [4].

Exploitation

An attacker does not require any special privileges or authentication to exploit this vulnerability. The unsafe code providing Send/Sync for AtomicBox is automatically available to any user of the crate who constructs an AtomicBox with a non-Send/Sync type T [1][4]. By sending or sharing such an AtomicBox across threads, a program can initiate data races on the inner type, even if the inner type is not designed for concurrent access. No user interaction beyond using the crate in a multi-threaded context is needed [4].

Impact

Successful exploitation can lead to undefined behavior, most commonly memory corruption due to data races [4]. The crate's advisory categorizes this under memory-corruption and thread-safety. The CVSS score is 8.1 (HIGH) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning an attacker may gain complete compromise of confidentiality, integrity, and availability [4]. The impact is magnified because the flaw is in a foundational type provided by the crate, affecting any program using AtomicBox with an unsuitable type in a multi-threaded environment.

Mitigation

The vulnerability is fixed in version 0.4.1 of abox [1][2][4]. The fix adds the required trait bounds T: Send and T: Sync to the unsafe impl blocks for the corresponding traits [2]. All users should upgrade to 0.4.1 or later. No workaround is available, as the flaw is inherent to the type's design; stopping multi-threaded use of AtomicBox with non-Send/Sync types is the only alternative. This CVE is not listed on CISA's Known Exploited Vulnerabilities catalog. [3]