PT-2020-17492 · Rust · Cbox Crate

Published 2020-03-19 · Updated 2021-08-25 · CVE-2020-35860

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cbox crate through 2020-03-19

Description An issue was discovered in the cbox crate, where the CBox API allows dereferencing raw pointers without requiring unsafe code. The CBox and CSemiBox components, part of the public API, enable creating smart pointers from raw pointers and dereferencing them without the need for unsafe code.

Recommendations For versions of the cbox crate through 2020-03-19, consider restricting the use of CBox and CSemiBox until a patch is available, as they allow dereferencing raw pointers without the need for unsafe code. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-35860

GHSA-3VJM-36RR-7QRQ

RUSTSEC-2020-0005

Affected Products

Cbox Crate

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0005.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35860 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35860 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3vjm-36rr-7qrq · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0005 · Vendor Advisory
• https://github.com/TomBebbington/cbox-rs · Note
• https://github.com/TomBebbington/cbox-rs/issues/2 · Note
• https://crates.io/crates/cbox · Note