From c8604c2616d6c9d51d66a3cab560ecb9bb378a71 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Fri, 26 Mar 2021 08:47:43 -0700 Subject: [PATCH] Add advisory for multiple issues in cgc --- crates/cgc/RUSTSEC-0000-0000.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 crates/cgc/RUSTSEC-0000-0000.md diff --git a/crates/cgc/RUSTSEC-0000-0000.md b/crates/cgc/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..04c87e898 --- /dev/null +++ b/crates/cgc/RUSTSEC-0000-0000.md @@ -0,0 +1,25 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "cgc" +date = "2020-12-10" +url = "https://github.com/playXE/cgc/issues/5" +categories = ["memory-corruption"] +keywords = ["memory-safety", "aliasing", "concurrency"] + +[versions] +patched = [] +``` + +# Multiple soundness issues in `Ptr` + +Affected versions of this crate have the following issues: + +1. `Ptr` implements `Send` and `Sync` for all types, this can lead to data + races by sending non-thread safe types across threads. + +2. `Ptr::get` violates mutable alias rules by returning multiple mutable + references to the same object. + +3. `Ptr::write` uses non-atomic writes to the underlying pointer. This means + that when used across threads it can lead to data races.