PT-2020-17538 · Rust · Futures-Task Crate

Published 2020-09-04 · Updated 2025-10-30 · CVE-2020-35906

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions futures-task crate versions prior to 0.3.6

Description An issue in the futures-task crate may cause a use-after-free in certain situations. The problem arises when the Waker::wake() function is called after the original data has been dropped, due to a missing 'static lifetime bound on the waker function.

Recommendations For versions prior to 0.3.6, update to version 0.3.6 or later to resolve the issue by adding a 'static lifetime bound to the data waker takes.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2020-35906

GHSA-R93V-9P5Q-VHPF

RUSTSEC-2020-0060

Affected Products

Futures-Task Crate

References · 12

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0060.html · Exploit
• https://osv.dev/vulnerability/GHSA-r93v-9p5q-vhpf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35906 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35906 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35906 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35906 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35906 · Security Note
• https://github.com/rust-lang/futures-rs · Note
• https://github.com/rust-lang/futures-rs/pull/2206 · Note
• https://t.me/cveNotify/140986 · Telegram Post
• https://crates.io/crates/futures-task · Note