PT-2020-17582 · Rust · Autorand

Published 2020-12-31 · Updated 2021-08-25 · CVE-2020-36210

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions autorand crate versions prior to 0.2.3

Description An issue in the autorand crate for Rust can lead to memory corruption due to the dropping of uninitialized memory when a panic occurs. This happens because of the implementation of Random on arrays. The problem arises when a user-provided function, T::random(), panics and drops a partially uninitialized array of T, potentially causing memory corruption or undefined behavior.

Recommendations For versions prior to 0.2.3, update to version 0.2.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the random() function in user-provided code until the update is applied.

Exploit

Fix

Use of Uninitialized Resource

Memory Corruption

Weakness Enumeration

CWE-908

CWE-787

Related Identifiers

CVE-2020-36210

GHSA-CGMG-2V6M-FJG7

RUSTSEC-2020-0103

Affected Products

Autorand

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0103.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36210 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36210 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgmg-2v6m-fjg7 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0103 · Vendor Advisory
• https://github.com/mersinvald/autorand-rs · Note
• https://github.com/mersinvald/autorand-rs/issues/5 · Note
• https://crates.io/crates/autorand · Note