PT-2020-17552 · Rust · Socket2
Published
2020-11-06
·
Updated
2022-05-24
·
CVE-2020-35920
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
socket2 versions prior to 0.3.16
Description
The issue arises from the socket2 crate assuming that
std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. This assumption leads to the crate simply casting pointers to convert socket addresses to the system representation. However, since the standard library does not guarantee a specific memory layout, any changes to the implementation could result in invalid memory access. Notably, such changes would not emit warnings or errors, potentially leading to unforeseen issues.Recommendations
For versions prior to 0.3.16, update to version 0.3.16 or later to resolve the issue. As a temporary workaround, consider avoiding the use of
std::net::SocketAddrV4 and std::net::SocketAddrV6 in situations where their memory layout might be critical until the update can be applied.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Socket2