Merge pull request #462 from RustSec/assign-ids

Assigned RUSTSEC-2020-0061 to futures-task
This commit is contained in:
Sergey "Shnatsel" Davidoff
2020-10-31 14:16:13 +01:00
committed by GitHub

View File

@@ -1,32 +1,32 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "futures-task"
date = "2020-05-03"
url = "https://github.com/rust-lang/futures-rs/issues/2091"
categories = ["denial-of-service"]
keywords = ["NULL pointer dereference", "memory-management"]
[versions]
patched = [">= 0.3.5"]
[affected]
functions = { "futures_task::noop_waker_ref" = [">= 0.3.0"] }
```
# futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer
Affected versions of the crate used a `UnsafeCell` in thread-local storage to return a noop waker reference,
assuming that the reference would never be returned from another thread.
This resulted in a segmentation fault crash if `Waker::wake_by_ref()` was called on a waker returned from another thread due to
it attempting to dereference a pointer that wasn't accesible from the main thread.
Reproduction Example (from issue):
```rust
use futures_task::noop_waker_ref;
fn main() {
let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap();
waker.wake_by_ref();
}
```
The flaw was corrected by using a `OnceCell::Lazy<>` wrapper around the noop waker instead of thread-local storage.
```toml
[advisory]
id = "RUSTSEC-2020-0061"
package = "futures-task"
date = "2020-05-03"
url = "https://github.com/rust-lang/futures-rs/issues/2091"
categories = ["denial-of-service"]
keywords = ["NULL pointer dereference", "memory-management"]
[versions]
patched = [">= 0.3.5"]
[affected]
functions = { "futures_task::noop_waker_ref" = [">= 0.3.0"] }
```
# futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer
Affected versions of the crate used a `UnsafeCell` in thread-local storage to return a noop waker reference,
assuming that the reference would never be returned from another thread.
This resulted in a segmentation fault crash if `Waker::wake_by_ref()` was called on a waker returned from another thread due to
it attempting to dereference a pointer that wasn't accesible from the main thread.
Reproduction Example (from issue):
```rust
use futures_task::noop_waker_ref;
fn main() {
let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap();
waker.wake_by_ref();
}
```
The flaw was corrected by using a `OnceCell::Lazy<>` wrapper around the noop waker instead of thread-local storage.