PT-2020-17583 · Rust · Gfwx

Published 2020-12-08 · Updated 2021-08-25 · CVE-2020-36211

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gfwx crate versions prior to 0.3.0

Description The issue arises from ImageChunkMut not having bounds on its Send trait or Sync trait, leading to potential data races and memory corruption. Specifically, ImageChunkMut<' , T> unconditionally implements Send and Sync, which can cause memory corruption or undefined behavior when non-thread-safe types are moved and referenced across thread boundaries.

Recommendations For versions prior to 0.3.0, update to version 0.3.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of ImageChunkMut across thread boundaries until the update is applied.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-662

CWE-787

Related Identifiers

CVE-2020-36211

GHSA-XP6V-QX65-4PP7

RUSTSEC-2020-0104

Affected Products

Gfwx

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0104.html · Exploit
• https://osv.dev/vulnerability/GHSA-xp6v-qx65-4pp7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36211 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0104 · Vendor Advisory
• https://github.com/Devolutions/gfwx-rs/issues/7 · Note
• https://github.com/Devolutions/gfwx-rs · Note
• https://crates.io/crates/gfwx · Note