diff --git a/crates/threadalone/RUSTSEC-0000-0000.md b/crates/threadalone/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..1633f5e --- /dev/null +++ b/crates/threadalone/RUSTSEC-0000-0000.md @@ -0,0 +1,28 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "threadalone" +date = "2024-01-07" +url = "https://github.com/cr0sh/threadalone/issues/1" +informational = "unsound" + +[versions] +patched = [">= 0.2.1"] +``` + +# Unsound sending of non-Send types across threads + +Affected versions can run the `Drop` impl of a non-Send type on a different +thread than it was created on. + +The flaw occurs when a stderr write performed by the `threadalone` crate fails, +for example because stderr is redirected to a location on a filesystem that is +full, or because stderr is a pipe that has been closed by the reader. + +Dropping a non-Send type on the wrong thread is unsound. If used with a type +such as a pthread-based `MutexGuard`, [the consequence is undefined +behavior][mutexguard]. If used with `Rc`, there would be a data race on the +reference count, which is likewise undefined behavior. + +[mutexguard]: https://github.com/rust-lang/rust/issues/23465#issuecomment-82730326 +