CVE-2020-36450

Vulnerability

The bunch crate (versions up to and including the 2020-11-12 release) unconditionally implements Send and Sync for Bunch without requiring T: Send or T: Sync [1][2]. This allows types that are not thread-safe, such as Cell, to be inserted into a Bunch and then shared across threads, leading to data races and undefined behavior [3].

Exploitation

An attacker can exploit this by writing Rust code that pushes a non-Sync type (e.g., Cell) into a Bunch, then wraps the Bunch in an Arc and shares it between threads. The proof-of-concept in reference [3] demonstrates a segmentation fault caused by a data race when one thread continuously modifies the Cell while another reads it. No special privileges or user interaction beyond running the code is required; the attack vector is network-based with high complexity [2].

Impact

Successful exploitation results in undefined behavior, memory corruption, and potential data races. This can lead to arbitrary code execution, information disclosure, or denial of service. The CVSS score is 8.1 (High) with high impact on confidentiality, integrity, and availability [2].

Mitigation

As of the RustSec advisory (RUSTSEC-2020-0130), no patched version of the bunch crate exists [2]. The recommended fix is to add T: Send and T: Sync bounds to the unsafe implementations. Until a fix is released, users should avoid using Bunch with non-thread-safe types or consider using alternative crates that properly enforce thread safety [4].