PT-2020-17618 · Rust · Ticketed Lock

Published 2020-11-17 · Updated 2021-08-25 · CVE-2020-36439

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ticketed lock crate versions prior to 0.3.0

Description The issue allows sending non-Send types to other threads by unconditionally implementing Send for ReadTicket and WriteTicket. This can create data races by cloning types with internal mutability and sending them to other threads, potentially causing memory corruption or other undefined behavior.

Recommendations For versions prior to 0.3.0, update to version 0.3.0 or later, which includes the fix by adding T: Send bounds to Send impls of ReadTicket and WriteTicket. As a temporary workaround, consider avoiding the use of ReadTicket and WriteTicket with non-Send types to minimize the risk of exploitation.

Fix

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-36439

GHSA-77M6-X95J-75R5

GHSA-GQ4H-F254-7CW9

RUSTSEC-2020-0119

Affected Products

Ticketed Lock

References · 12

• https://osv.dev/vulnerability/CVE-2020-36439 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq4h-f254-7cw9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36439 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0119 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77m6-x95j-75r5 · Vendor Advisory
• https://github.com/kvark/ticketed_lock · Note
• https://github.com/kvark/ticketed_lock/commit/a986a9335d591fa5c826157d1674d47aa525357f · Note
• https://github.com/kvark/ticketed_lock/issues/7 · Note
• https://t.me/cibsecurity/26985 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2020-0119.html · Note
• https://crates.io/crates/ticketed_lock · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ticketed_lock/RUSTSEC-2020-0119.md · Note