https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 13:56:38 +0000 https://cve.radiocsirt.org/vuln/cve-2020-35907 <p>An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference.</p> <p>An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference.</p> https://cve.radiocsirt.org/vuln/cve-2020-35907 https://cve.radiocsirt.org/vuln/rustsec-2020-0061 <p><strong>Affected:</strong> crates.io: futures-task</p> <p>Affected versions of the crate used a `UnsafeCell` in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread.</p> <p>This resulted in a segmentation fault crash if `Waker::wake_by_ref()` was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn&#39;t accessible from the main thread.</p> <p>Reproduction Example (from issue): ```rust use futures_task::noop_waker_ref; fn main() { let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap(); waker.wake_by_ref(); } ```</p> <p>The flaw was corrected by using a `OnceCell::Lazy&lt;&gt;` wrapper around the noop waker instead of thread-local storage.</p> <p><strong>Affected:</strong> crates.io: futures-task</p> <p>Affected versions of the crate used a `UnsafeCell` in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread.</p> <p>This resulted in a segmentation fault crash if `Waker::wake_by_ref()` was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn&#39;t accessible from the main thread.</p> <p>Reproduction Example (from issue): ```rust use futures_task::noop_waker_ref; fn main() { let waker = std::thread::spawn(|| noop_waker_ref()).join().unwrap(); waker.wake_by_ref(); } ```</p> <p>The flaw was corrected by using a `OnceCell::Lazy&lt;&gt;` wrapper around the noop waker instead of thread-local storage.</p> https://cve.radiocsirt.org/vuln/rustsec-2020-0061