PT-2020-17532 · Rust · Array-Queue

Published 2020-09-26 · Updated 2021-08-25 · CVE-2020-35900

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions array-queue crate through 2020-09-26

Description The issue arises from the pop back function in the array-queue crate, which fails to properly index into the array. This allows the reading of previously dropped or uninitialized memory, potentially leading to a use-after-free scenario. The array-queue crate implements a circular queue that wraps around an array.

Recommendations For array-queue crate through 2020-09-26, consider disabling the pop back function until a patch is available to prevent potential use-after-free issues. Restrict access to the pop back function to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2020-35900

GHSA-75CQ-G75G-RXFF

RUSTSEC-2020-0047

Affected Products

Array-Queue

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0047.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35900 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35900 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0047 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75cq-g75g-rxff · Vendor Advisory
• https://github.com/raviqqe/array-queue · Note
• https://github.com/raviqqe/array-queue/issues/2 · Note
• https://crates.io/crates/array-queue · Note