PT-2020-17558 · Rust · Nanorand

Aspenluxxxy · Published 2020-12-09 · Updated 2021-08-25 · CVE-2020-35926

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nanorand versions prior to 0.5.1

Description An issue in the nanorand crate caused random number generators, including the cryptographically secure ChaCha, to return all zeroes due to mishandled integer truncation. This occurred because the implementation used bit-shifting to truncate a 64-bit number instead of an as conversion, leading to improper number generation.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of random number generators that rely on the affected RandomGen implementations until a patch is available.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-681

CWE-330

CWE-338

Related Identifiers

CVE-2020-35926

GHSA-M9M5-CG5H-R582

RUSTSEC-2020-0089

Affected Products

Nanorand

References · 9

• https://osv.dev/vulnerability/GHSA-m9m5-cg5h-r582 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35926 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35926 · Security Note
• https://github.com/Absolucy/nanorand-rs · Note
• https://github.com/Absolucy/nanorand-rs/commit/5ba218ac29df4786b002d7d12b47fa0c04a331f2 · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0089.html · Note
• https://twitter.com/aspenluxxxy/status/1336684692284772352 · Note
• https://crates.io/crates/nanorand · Note