CVE-2020-35912
Data races in lock_api
CVE-2020-35912 is a medium vulnerability (CVSS 4.7) in Lock Api Project Api, published November 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in lock_api 0.4.2.
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
CVE-2020-35912- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
CVE-2020-35912- Updated
- 2026-11-02
EUVDEUVD-2021-1583 No score
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
EUVD-2021-1583- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5wg8-7c9q-794v
Data races in lock_api
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
GHSA-5wg8-7c9q-794v- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVCVE-2020-35910
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness.
- Record
CVE-2020-35910- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCVE-2020-35911
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness.
- Record
CVE-2020-35911- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSV
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
CVE-2020-35912- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCVE-2020-35913
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
- Record
CVE-2020-35913- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCVE-2020-35914
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
- Record
CVE-2020-35914- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-35912
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
DEBIAN-CVE-2020-35912- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-5wg8-7c9q-794v
Data races in lock_api
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
GHSA-5wg8-7c9q-794v- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-gmv4-vmx3-x9f3
Data races in lock_api
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
- Record
GHSA-gmv4-vmx3-x9f3- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-hj9h-wrgg-hgmx
Data races in lock_api
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
- Record
GHSA-hj9h-wrgg-hgmx- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-ppj3-7jw3-8vc4
Data races in lock_api
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness.
- Record
GHSA-ppj3-7jw3-8vc4- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVGHSA-vh4p-6j7g-f4j9
Data races in lock_api
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness.
- Record
GHSA-vh4p-6j7g-f4j9- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-35912
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
- Record
UBUNTU-CVE-2020-35912- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRUSTSEC-2020-0070 No score
Some lock_api lock guard objects can cause data races
Affected versions of lock_api had unsound implementations of the Send or
Sync traits for some guard objects, namely:
- MappedMutexGuard
- MappedRwLockReadGuard
- MappedRwLockWriteGuard
- RwLockReadGuard
- RwLockWriteGuard
These guards could allow data races through types that are not safe to Send
across thread boundaries in safe Rust code.
This issue was fixed by changing the trait bounds on the Mapped guard types
and removing the Sync trait for the RwLock guards.
- Record
RUSTSEC-2020-0070- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lock_apicrates.io |
before 0.4.2 | 0.4.2 |
rust-lock-apiDebian:12 |
before 0.4.5-1 | 0.4.5-1 |
rust-lock-apiDebian:13 |
before 0.4.5-1 | 0.4.5-1 |
rust-lock-apiDebian:14 |
before 0.4.5-1 | 0.4.5-1 |
lock_apicrates.io |
0.0.0-0 up to 0.4.2 | 0.4.2 |
rust-lock-apiUbuntu:20.04:LTS |
All versions, plus listed versions 0.1.5-10.3.1-10.3.2-10.3.3-1 |
None known |
rust-lock-apiUbuntu:22.04:LTS |
All versions, plus listed versions 0.3.4-10.4.5-1 |
None known |
rust-lock-apiUbuntu:24.04:LTS |
All versions, plus listed versions 0.4.9-10.4.11-1 |
None known |
rust-lock-apiUbuntu:25.10 |
All versions, plus listed versions 0.4.12-1 |
None known |
rust-lock-apiUbuntu:26.10 |
All versions, plus listed versions 0.4.14-1 |
None known |
rust-lock-apiUbuntu:26.04:LTS |
All versions, plus listed versions 0.4.12-10.4.13-10.4.14-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
rustsec.org/advisories/RUSTSEC-2020-0070.html
nvd.nist.gov/vuln/detail/CVE-2020-35912
github.com/Amanieu/parking_lot/pull/262
security-tracker.debian.org/tracker/CVE-2020-35912
Show 8 moreShow less
crates.io/crates/lock_api
ubuntu.com/security/CVE-2020-35912
cve.org/CVERecord?id=CVE-2020-35912