PT-2020-17574 · Rust · Reffers

Published 2020-12-01 · Updated 2021-08-25 · CVE-2020-36203

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions reffers crate through 2020-12-01

Description The issue arises from the ARefss<'a, V> type, which is assumed to contain objects that are Send + Sync. However, in the affected versions, Send/Sync traits are unconditionally implemented for ARefss<'a, V>. This allows the insertion of a !Send or !Sync object into ARefss<'a, V> using the ARefss::map() API. As a result, a data race can be created to the inner object of ARefss<'a, V>, leading to undefined behavior and memory corruption.

Recommendations To resolve the issue, update the reffers crate to a version that includes the fix from commit 6dd7ca0, which adds the trait bound V: Send + Sync to the ARefss::map() API. As a temporary workaround, consider avoiding the use of the ARefss::map() API with objects that are not Send + Sync.

Exploit

Fix

Race Condition

Memory Corruption

Weakness Enumeration

CWE-362

CWE-787

Related Identifiers

CVE-2020-36203

GHSA-39XG-8P43-H76X

RUSTSEC-2020-0094

Affected Products

Reffers

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0094.html · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2020-0094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36203 · Security Note
• https://osv.dev/vulnerability/GHSA-39xg-8p43-h76x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36203 · Vendor Advisory
• https://github.com/diwic/reffers-rs/commit/6dd7ca0d50f2464df708975cdafcfaeeb6d41c66 · Note
• https://github.com/diwic/reffers-rs/issues/7 · Note
• https://github.com/diwic/reffers-rs · Note
• https://crates.io/crates/reffers · Note
• https://t.me/cvenotify/9308 · Telegram Post