PT-2020-17527 · Rust · Stack Crate

Published 2020-09-24 · Updated 2022-12-14 · CVE-2020-35895

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions stack crate versions prior to 0.3.1

Description The issue is related to the ArrayVec in the stack crate, where the insert method allows insertion of an element into the array object at a specified index. Due to a missing check on the upper bound of this index, it is possible to write out of bounds. This can lead to an out-of-bounds write via element insertion.

Recommendations For versions prior to 0.3.1, update to version 0.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ArrayVec::insert method to prevent out-of-bounds writes until a patch is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-35895

GHSA-H45V-VGVP-3H5V

RUSTSEC-2020-0042

Affected Products

Stack Crate

References · 9

• https://osv.dev/vulnerability/CVE-2020-35895 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h45v-vgvp-3h5v · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35895 · Security Note
• https://github.com/arcnmx/stack-rs/issues/4 · Note
• https://github.com/arcnmx/stack-rs/commit/369e55736f9bd29c37b1712afc2923f4028148c6 · Note
• https://github.com/arcnmx/stack-rs · Note
• https://crates.io/crates/stack · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0042.html · Note