PT-2020-17494 · Rust · Bitvec

Published 2020-03-27 · Updated 2021-08-25 · CVE-2020-35862

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bitvec crate versions prior to 0.17.4

Description The issue arises from the conversion of BitVec to BitBox, which can lead to a use-after-free or double free. This occurs because the conversion did not account for allocation movement, using the original base address instead of the address after resizing.

Recommendations For versions prior to 0.17.4, update to version 0.17.4 or later to resolve the issue. As a temporary workaround, consider avoiding the conversion of BitVec to BitBox until the update is applied.

Exploit

Fix

Double Free

Use After Free

Weakness Enumeration

CWE-415

CWE-416

Related Identifiers

CVE-2020-35862

GHSA-7CJC-HVXF-GQH7

RUSTSEC-2020-0007

Affected Products

Bitvec

References · 9

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0007.html · Exploit
• https://osv.dev/vulnerability/GHSA-7cjc-hvxf-gqh7 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35862 · Security Note
• https://github.com/myrrlyn/bitvec · Note
• https://github.com/myrrlyn/bitvec/issues/55 · Note
• https://t.me/cibsecurity/21466 · Telegram Post
• https://crates.io/crates/bitvec · Note