PT-2020-17577 · Rust · Rusb

Published 2020-12-18 · Updated 2021-08-25 · CVE-2020-36206

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rusb versions prior to 0.7.0

Description The issue is related to a lack of Send and Sync bounds in the rusb crate, which can lead to data races and memory corruption. This occurs because UsbContext types that are not thread-safe can be used concurrently through Device and DeviceHandle across threads.

Recommendations For versions prior to 0.7.0, update to version 0.7.0 or later, which includes the fix by adding Send and Sync bounds to UsbContext. As a temporary workaround, consider avoiding the use of UsbContexts across threads to minimize the risk of data races and memory corruption.

Fix

Memory Corruption

Weakness Enumeration

CWE-662

CWE-787

Related Identifiers

CVE-2020-36206

GHSA-9MXW-4856-9CM5

RUSTSEC-2020-0098

Affected Products

Rusb

References · 8

• https://osv.dev/vulnerability/CVE-2020-36206 · Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2020-0098.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36206 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0098 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9mxw-4856-9cm5 · Vendor Advisory
• https://github.com/a1ien/rusb/issues/44 · Note
• https://github.com/a1ien/rusb · Note
• https://crates.io/crates/rusb · Note