Rust advisories / noise_search
Vulnerability HighRUSTSEC-2020-0141 · noise_search
RUSTSEC-2020-0141: MvccRwLock allows data races & aliasing violations
Short answerA security vulnerability in the noise_search crate: MvccRwLock allows data races & aliasing violations. High severity (CVSS 8.1). No fixed version: replace the crate or remove the affected code path.
| Crate | noise_search |
|---|---|
| Type | Vulnerability (memory-corruption, thread-safety) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High, CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-12-10 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-36461, GHSA-wxjf-9f4g-3v44 |
What to do
- Find who pulls it in:
cargo tree -i noise_search. - Avoid the affected API, or replace the crate.
Details from the advisory
Affected versions of this crate unconditionally implement Send/Sync for MvccRwLock. This can lead to data races when types that are either !Send or !Sync (e.g. Rc<T>, Arc<Cell<_>>) are contained inside MvccRwLock and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).
Also, safe APIs of MvccRwLock allow aliasing violations by allowing &T and LockResult<MutexGuard<Box<T>>> to co-exist in conflicting lifetime regions. The APIs of MvccRwLock should either be marked as unsafe or MbccRwLock should be changed to private or pub(crate).
References
- Package: crates.io/crates/noise_search
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0141.html
- Report: github.com/pipedown/noise/issues/72
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?