PT-2020-16214 · Rust+3 · Sized-Chunks Crate+3
Published
2020-09-06
·
Updated
2026-03-23
·
CVE-2020-25794
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
sized-chunks crate versions through 0.6.2
Description
An issue was discovered in the sized-chunks crate, where the Chunk implementation has memory-safety issues. Specifically, the array size is not checked when constructed with
unit(), pair(), or From<InlineArray<A, T>>. Additionally, Clone and insert from are not panic-safe, as a panicking iterator can cause memory safety issues. The InlineArray implementation generates unaligned references for types with a large alignment requirement.Recommendations
For sized-chunks crate versions through 0.6.2, consider disabling the
Clone and insert from functions until a patch is available to prevent memory safety issues. Restrict the use of unit(), pair(), and From<InlineArray<A, T>> when constructing the Chunk implementation to minimize the risk of exploitation. Avoid using the InlineArray implementation for types with large alignment requirements until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Validation of Array Index
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Ubuntu
Sized-Chunks Crate