CVE-2020-35907
MEDIUM5.5EPSS 0.05%futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer
描述
Affected versions of the crate used a `UnsafeCell` in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread. This resulted in a segmentation fault crash if `Waker::wake_by_ref()` was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn't accessible from the main thread. Reproduction Example (from issue): ```rust use futures_task::noop_waker_ref; fn main() { let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap(); waker.wake_by_ref(); } ``` The flaw was corrected by using a `OnceCell::Lazy<>` wrapper around the noop waker instead of thread-local storage.
受影響套件(2)
- crates.io/futures-taskfrom 0, < 0.3.5
- crates.io/futures-task>= 0.0.0-0, < 0.3.5
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |