PT-2020-17580 · Rust · Late-Static Crate

Published 2020-11-10 · Updated 2021-08-25 · CVE-2020-36209

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions late-static crate versions prior to 0.4.0

Description An issue in the late-static crate allows a data race to occur because Sync is implemented for LateStatic with T: Send. This can result in a data race to a type T: Send + !Sync, such as Cell, leading to memory corruption or undefined behavior.

Recommendations For versions prior to 0.4.0, update to version 0.4.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Sync with T: Send for LateStatic to minimize the risk of data races. Restrict access to types that implement T: Send + !Sync, such as Cell, to prevent potential memory corruption or undefined behavior.

Exploit

Fix

Weakness Enumeration

CWE-662

Related Identifiers

CVE-2020-36209

GHSA-WR55-MF5C-HHWM

RUSTSEC-2020-0102

Affected Products

Late-Static Crate

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0102.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36209 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0102 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36209 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wr55-mf5c-hhwm · Vendor Advisory
• https://github.com/Richard-W/late-static/issues/1 · Note
• https://github.com/Richard-W/late-static · Note
• https://github.com/Richard-W/late-static/commit/11f396c · Note
• https://t.me/cibsecurity/22607 · Telegram Post
• https://crates.io/crates/late-static · Note