From 65f49796ee3ee29e2eb4cc7ee32a45094e6e30b3 Mon Sep 17 00:00:00 2001 From: David Tolnay Date: Sun, 10 Sep 2023 17:54:03 -0700 Subject: [PATCH] Inventory 0.1 is unsound (exposure of non-Sync reference) (#1775) --- crates/inventory/RUSTSEC-0000-0000.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 crates/inventory/RUSTSEC-0000-0000.md diff --git a/crates/inventory/RUSTSEC-0000-0000.md b/crates/inventory/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..85a78d8 --- /dev/null +++ b/crates/inventory/RUSTSEC-0000-0000.md @@ -0,0 +1,25 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "inventory" +date = "2023-09-10" +url = "https://github.com/dtolnay/inventory/pull/42" +informational = "unsound" +categories = ["thread-safety"] +keywords = ["life-before-main"] + +[versions] +patched = [">= 0.2.0"] +``` + +# Exposes reference to non-Sync data to an arbitrary thread + +Affected versions do not enforce a `Sync` bound on the type of caller-provided +value held in the plugin registry. References to these values are made +accessible to arbitrary threads other than the one that constructed them. + +A caller could use this flaw to submit thread-unsafe data into inventory, then +access it as a reference simultaneously from multiple threads. + +The flaw was corrected by enforcing that data submitted by the caller into +inventory is `Sync`.