PT-2019-19976 · Rust+1 · Snafu+6

Qwaz

·

Published

2019-11-13

·

Updated

2024-08-04

·

CVE-2020-25575

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions failure crate versions 0.1.5 and earlier
Description The issue presents a type confusion flaw when downcasting, which may introduce compatibility hazards in some applications. This affects products that are no longer supported by the maintainer. Safe Rust code can implement malfunctioning private get type id and cause type confusion when downcasting, which is an undefined behavior. Users who derive Fail trait are not affected.
Recommendations For failure crate versions 0.1.5 and earlier, consider switching to actively developed alternatives such as anyhow, eyre, fehler, snafu, or thiserror to mitigate the risk. As a temporary workaround, avoid using the private get type id function until a patch is available. Restrict the use of the failure crate to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Type Confusion

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2020-25575
GHSA-JQ66-XH47-J9F3
GHSA-R98R-J25Q-RMPR
RUSTSEC-2019-0036
RUSTSEC-2020-0036

Affected Products

Debian
Anyhow
Eyre
Failure
Fehler
Snafu
Thiserror