CVE-2020-36451
📋 TL;DR
This vulnerability in the rcu_cell Rust crate allows data races and memory corruption by incorrectly implementing Send and Sync traits for RcuCell<T> regardless of the type T's thread safety. This affects any Rust application using vulnerable versions of the rcu_cell crate, potentially leading to undefined behavior and security issues.
💻 Affected Systems
- rcu_cell Rust crate
📦 What is this software?
Rcu Cell by Rcu Cell Project
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, denial of service, or data integrity compromise in multi-threaded Rust applications.
Likely Case
Data races causing undefined behavior, application crashes, or incorrect program execution in concurrent Rust code.
If Mitigated
No impact if applications don't use rcu_cell or have proper thread safety controls and type constraints.
🎯 Exploit Status
Exploitation requires application-specific conditions where non-thread-safe types are used with RcuCell in concurrent contexts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2020-11-14 (specifically fixed in commit addressing the issue)
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0131.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to use rcu_cell version > 0.1.5 or specify git commit with fix. 2. Run 'cargo update rcu_cell'. 3. Rebuild and redeploy application.
🔧 Temporary Workarounds
Avoid rcu_cell usage
allReplace rcu_cell with alternative thread-safe synchronization primitives from Rust's standard library.
cargo remove rcu_cell
cargo add std::sync::Arc or other appropriate types
Manual trait bounds
allAdd explicit Send/Sync trait bounds on types used with RcuCell to ensure thread safety.
Modify Rust code to add where T: Send + Sync constraints
🧯 If You Can't Patch
- Audit code for RcuCell usage with non-thread-safe types and refactor to avoid concurrent access.
- Implement runtime checks or wrapper types that enforce thread safety before using RcuCell.
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for rcu_cell dependency version ≤ 0.1.5 or with commit date ≤ 2020-11-14.Check Version:
grep rcu_cell Cargo.lock || cargo tree | grep rcu_cellVerify Fix Applied:
Verify rcu_cell version > 0.1.5 in Cargo.lock and that Send/Sync implementations are conditional on T's traits.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Data race warnings from Rust's MIRI or sanitizers
Network Indicators:
- Unusual application behavior under concurrent load
SIEM Query:
Process monitoring for Rust application crashes with memory-related error codes