PT-2020-15891 · Rust+1 · Rgb Crate+1
Heroickatora
·
Published
2020-06-14
·
Updated
2021-08-25
·
CVE-2020-25016
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
rgb crate versions prior to 0.8.20
Description
A safety issue was discovered in the rgb crate, which can lead to dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations, and the crate does not correctly constrain wrapper structures to safe types. If a type
T wrapped in RGB<T> contains padding, viewing it as bytes may expose contents of uninitialized memory. If T contains a pointer, modifying it as bytes may lead to dereferencing of arbitrary pointers. Any safety and/or validity invariants for T may be violated.Recommendations
For versions prior to 0.8.20, the issue was resolved by requiring all types wrapped in structures provided by the RGB crate to implement an unsafe marker trait. Update to version 0.8.20 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
RGB<T> wrapper structure until the update is applied.Exploit
Fix
Type Confusion
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Rgb Crate