PT-2020-17493 · Rust · Bumpalo
Published
2020-03-24
·
Updated
2021-08-25
·
CVE-2020-35861
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
bumpalo crate versions prior to 3.2.1
Description
An issue in the bumpalo crate allows the reading of unknown memory due to a bug in the
realloc feature. This could potentially allow attackers to read sensitive information, such as cryptographic keys, if they can cause reallocs and read the realloced data back. The bug occurs when copying bytes into the new space during realloc, where new size number of bytes are copied instead of old size, leading to copying bytes from past the chunk being allocated.Recommendations
For bumpalo crate versions prior to 3.2.1, update to version 3.2.1 or later to fix the bug. As a temporary workaround, consider restricting the use of the
realloc feature until a patch is available. Additionally, enabling the --error-exitcode=1 flag for valgrind in CI can help detect invalid reads/writes, and exercising realloc via bumpalo::collections::Vec::resize and bumpalo::collections::Vec::shrink to fit calls can help identify potential issues.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bumpalo