PT-2020-17529 · Rust · Atom

Published 2020-09-21 · Updated 2021-08-25 · CVE-2020-35897

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions atom crate versions prior to 0.3.6

Description The issue revolves around the atom crate's implementation of the Send trait, which incorrectly allows any arbitrary type to be sent across threads. This can potentially lead to use-after-free issues through memory races due to an unsafe Send implementation, allowing a cross-thread data race.

Recommendations For versions prior to 0.3.6, update to version 0.3.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Send trait implementation in the atom crate to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2020-35897

GHSA-9CG2-2J2H-59V9

RUSTSEC-2020-0044

Affected Products

Atom

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2020-35897 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0044 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9cg2-2j2h-59v9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35897 · Vendor Advisory
• https://github.com/slide-rs/atom · Note
• https://github.com/slide-rs/atom/issues/13 · Note
• https://crates.io/crates/atom · Note
• https://t.me/cibsecurity/21469 · Telegram Post
• https://t.me/cvenotify/8264 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2020-0044.html · Note