PT-2020-17400 · Rust · Arc-Swap

Qwazo · Published 2020-12-10 · Updated 2022-05-24 · CVE-2020-35711

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions arc-swap crate versions prior to 0.4.8 arc-swap crate versions 1.x prior to 1.1.0

Description An issue has been discovered in the arc-swap crate for Rust. Use of arc swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.

Recommendations For versions prior to 0.4.8, update to version 0.4.8 or later to resolve the issue. For versions 1.x prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. As a temporary workaround, consider replacing the implementation with one that does not use unsafe, at the cost of added Clone bound on the closure and a small penalty on performance.

Exploit

Fix

Related Identifiers

CVE-2020-35711

GHSA-9PQX-G3JH-QPQQ

RUSTSEC-2020-0091

Affected Products

Arc-Swap

References · 15

• 🔥 https://github.com/vorner/arc-swap/issues/45 · Exploit
• https://osv.dev/vulnerability/CVE-2020-35711 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35711 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-35711 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35711 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35711 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9pqx-g3jh-qpqq · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35711 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0091 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35711 · Vendor Advisory
• https://github.com/vorner/arc-swap · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0091.html · Note
• https://crates.io/crates/arc-swap · Note
• https://t.me/cvenotify/7740 · Telegram Post
• https://t.me/cibsecurity/21306 · Telegram Post