Affected versions of rusb did not require UsbContext to implement Send and Sync. However, through Device and DeviceHandle it is possible to use UsbContexts across threads. This issue allows non-thread safe UsbContext types to be used concurrently leading to data races and memory corruption. The issue was fixed by adding Send and Sync bounds to UsbContext.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-36206
• a1ien/rusb#44
• https://rustsec.org/advisories/RUSTSEC-2020-0098.html