PT-2020-16212 · Rust+3 · Sized-Chunks Crate+3
Qwazo
·
Published
2020-09-06
·
Updated
2026-03-23
·
CVE-2020-25792
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
sized-chunks crate versions through 0.6.2
Description
An issue was discovered in the sized-chunks crate, where the array size is not checked when constructed with
unit() and pair() in the Chunk implementation. Additionally, the array size is not checked when constructed with From<InlineArray<A, T>>. The Clone and insert from functions are not panic-safe, as a panicking iterator can cause memory safety issues. In the InlineArray implementation, unaligned references may be generated for types with a large alignment requirement.Recommendations
For sized-chunks crate versions through 0.6.2, consider updating to a version that addresses these issues. As a temporary workaround, consider adding manual checks for array size when constructing with
unit() and pair() to prevent potential memory safety issues. Additionally, restrict the use of Clone and insert from functions until a patch is available to prevent memory safety issues caused by panicking iterators. Avoid using the InlineArray implementation for types with large alignment requirements until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Validation of Array Index
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Ubuntu
Sized-Chunks Crate