PT-2019-19977 · Rust · Rand Core

Published 2019-04-19 · Updated 2021-08-25 · CVE-2020-25576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rand core versions prior to 0.4.2

Description An issue was discovered in the rand core crate where casting of byte slices to integer slices mishandles alignment constraints, resulting in undefined behavior. The functions rand core::BlockRng::next u64 and rand core::BlockRng::fill bytes are affected.

Recommendations For versions prior to 0.4.2, update to version 0.4.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of rand core::BlockRng::next u64 and rand core::BlockRng::fill bytes functions until the update is applied.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2020-25576

GHSA-MMC9-PWM7-QJ5W

RUSTSEC-2019-0035

Affected Products

Rand Core

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2020-25576 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-25576 · Security Note
• https://osv.dev/vulnerability/GHSA-mmc9-pwm7-qj5w · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25576 · Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2019-0035.html · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2019-0035 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25576 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-25576 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25576 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25576 · Vendor Advisory
• https://github.com/rust-random/rand · Note
• https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06 · Note
• https://github.com/rust-random/rand/security/advisories/GHSA-mmc9-pwm7-qj5w · Note
• https://crates.io/crates/rand_core · Note