PT-2020-17539 · Rust · Futures-Task Crate
Published
2020-05-03
·
Updated
2022-05-24
·
CVE-2020-35907
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
futures-task crate versions prior to 0.3.5
Description
An issue in the futures-task crate allows a NULL pointer dereference. The affected versions of the crate used an
UnsafeCell in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread. This resulted in a segmentation fault crash if Waker::wake by ref() was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn't accessible from the main thread.Recommendations
For versions prior to 0.3.5, update to version 0.3.5 or later to resolve the issue. As a temporary workaround, consider avoiding the use of
futures task::noop waker ref() in multi-threaded environments until a patch is applied. Restrict access to the Waker::wake by ref() function to minimize the risk of exploitation.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Futures-Task Crate