CVE-2020-36441
Data race in abox
An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Send and T: Sync.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
8.1
An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Send and T: Sync.
- Record
CVE-2020-36441- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Send and T: Sync.
- Record
CVE-2020-36441- Updated
- 2026-11-02
EUVDEUVD-2021-1855 No score
An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Send and T: Sync.
- Record
EUVD-2021-1855- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r626-fc64-3q28
8.1
Data race in abox
Affected versions of this crate implements Send/Sync for AtomicBox<T> without requiring T: Send/T: Sync. This allows to create data races to T: !Sync and send T: !Send to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit 34c2b9e by adding trait bound T: Send to Send impl for AtomicBox<T> and trait bound T: Sync to Sync impl for AtomicBox<T>.
- Record
GHSA-r626-fc64-3q28- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-362
- Updated
- 2026-11-02
OSVGHSA-r626-fc64-3q28
8.1
Data race in abox
Affected versions of this crate implements Send/Sync for AtomicBox<T> without requiring T: Send/T: Sync. This allows to create data races to T: !Sync and send T: !Send to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit 34c2b9e by adding trait bound T: Send to Send impl for AtomicBox<T> and trait bound T: Sync to Sync impl for AtomicBox<T>.
- Record
GHSA-r626-fc64-3q28- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-362
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0121
8.1
AtomicBox<T> implements Send/Sync for any `T: Sized`
Affected versions of this crate implements Send/Sync for AtomicBox<T> without requiring T: Send/T: Sync. This allows to create data races to T: !Sync and send T: !Send to another thread.
Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race).
The flaw was corrected in commit 34c2b9e by adding trait bound T: Send to Send impl for AtomicBox<T> and trait bound T: Sync to Sync impl for AtomicBox<T>.
- Record
RUSTSEC-2020-0121- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36441 is a high vulnerability (CVSS 8.1) in Abox Project Abox, published November 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in abox 0.4.1.
References
rustsec.org/advisories/RUSTSEC-2020-0121.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md
nvd.nist.gov/vuln/detail/CVE-2020-36441
github.com/SonicFrog/abox/issues/1
github.com/SonicFrog/abox/pull/2
github.com/SonicFrog/abox/commit/34c2b9e
github.com/advisories/GHSA-r626-fc64-3q28
github.com/SonicFrog/abox
crates.io/crates/abox