PT-2020-17588 · Rust · Eventio

Published 2020-12-20 · Updated 2021-08-25 · CVE-2020-36216

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions eventio crate versions prior to 0.5.1

Description An issue in the eventio crate allows a non-Send type to be sent to a different thread, potentially causing a data race and memory corruption. This occurs because Input<R> implements Send without requiring R: Send, leading to undefined behavior when non-Send types are sent to other threads.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later, which includes the R: Send bound to the Send impl of Input<R>, correcting the flaw.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-662

CWE-787

Related Identifiers

CVE-2020-36216

GHSA-69VJ-XX27-G45W

RUSTSEC-2020-0108

Affected Products

Eventio

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0108.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36216 · Security Note
• https://osv.dev/vulnerability/GHSA-69vj-xx27-g45w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36216 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0108 · Vendor Advisory
• https://github.com/petabi/eventio/issues/33 · Note
• https://github.com/petabi/eventio · Note
• https://crates.io/crates/eventio · Note