PT-2020-17590 · Rust · Buttplug

Published 2020-12-18 · Updated 2021-08-25 · CVE-2020-36218

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions buttplug crate versions prior to 1.0.4

Description The issue arises from ButtplugFutureStateShared not properly handling objects that do not implement Send or Sync, leading to potential data races and undefined behavior when moving non-Send types across thread boundaries or accessing non-Sync types from multiple threads. This can occur with types like Rc<T> for non-Send cases and Arc<Cell< >> for non-Sync cases.

Recommendations For buttplug crate versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue by allowing rustc to generate auto trait implementations with correct trait bounds on T.

Exploit

Fix

Weakness Enumeration

CWE-662

Related Identifiers

CVE-2020-36218

GHSA-R7RV-2RPH-HVHJ

RUSTSEC-2020-0112

Affected Products

Buttplug

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0112.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-36218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36218 · Security Note
• https://osv.dev/vulnerability/GHSA-r7rv-2rph-hvhj · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0112 · Vendor Advisory
• https://github.com/buttplugio/buttplug-rs · Note
• https://github.com/buttplugio/buttplug-rs/issues/225 · Note
• https://crates.io/crates/buttplug · Note