CVE-2021-28037

Vulnerability

Description

The internment crate (versions prior to 0.4.2) unconditionally implements Sync for Intern, even when T is not Sync [1][3]. This violates Rust's thread-safety guarantees, as Sync is intended only for types that are safe to share across threads. The flaw was introduced because the Intern type uses unsafe impl Sync for Intern {} without requiring T: Sync [4].

Exploitation

An attacker can exploit this by constructing an Intern where T is a non-Sync type (e.g., Cell<...>) and then sharing that interned value across threads using safe APIs [4]. The provided reproduction demonstrates a data race where one thread writes to a Cell while another reads it, leading to undefined behavior such as reading a dangling pointer [4]. No special privileges or user interaction are required; the attack can be launched over a network if the application processes untrusted data [2][3].

Impact

Successful exploitation results in memory corruption, which can lead to arbitrary code execution, information disclosure, or denial of service [2][3]. The CVSS score is 9.8 (Critical) with high impacts on confidentiality, integrity, and availability [3].

Mitigation

The issue is fixed in version 0.4.2 of the internment crate [3]. Users should update to this version or later. No workarounds are available for affected versions [3].