PT-2020-17511 · Rust · Rulinalg

Athemathmo · Published 2020-02-11 · Updated 2021-08-25 · CVE-2020-35879

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rulinalg versions through 2020-02-11

Description An issue was discovered in the rulinalg crate, where there are incorrect lifetime-boundary definitions for RowMut::raw slice and RowMut::raw slice mut. These definitions do not conform with Rust's borrowing rule, allowing the creation of multiple mutable references to the same location. This may result in unexpected calculation results and data races if both references are used at the same time.

Recommendations For versions through 2020-02-11, consider restricting the use of RowMut::raw slice and RowMut::raw slice mut to prevent creating multiple mutable references to the same location until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2020-35879

GHSA-Q2GJ-9R85-P832

RUSTSEC-2020-0023

Affected Products

Rulinalg

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0023.html · Exploit
• https://osv.dev/vulnerability/GHSA-q2gj-9r85-p832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35879 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35879 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0023 · Vendor Advisory
• https://github.com/AtheMathmo/rulinalg/issues/201 · Note
• https://github.com/AtheMathmo/rulinalg · Note
• https://t.me/cibsecurity/21455 · Telegram Post
• https://t.me/cvenotify/8261 · Telegram Post
• https://crates.io/crates/rulinalg · Note