PT-2020-17622 · Rust · Beef

Published 2020-10-28 · Updated 2021-08-25 · CVE-2020-36442

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions beef crate versions prior to 0.5.0

Description An issue was discovered in the beef crate for Rust, where beef::Cow has no Sync bound on its Send trait. This allows users to create data races by making Cow contain types that are (Send && !Sync) like Cell< > or RefCell< >. Such data races can lead to memory corruption.

Recommendations For versions prior to 0.5.0, update to version 0.5.0 or later, which includes the corrected Send impl for Cow<' , T, U> with added trait bounds T: Sync and T::Owned: Send. As a temporary workaround, consider avoiding the use of Cow with types that are (Send && !Sync) until the issue is resolved.

Fix

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-36442

GHSA-M7W4-8WP8-M2XQ

RUSTSEC-2020-0122

Affected Products

Beef

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-36442 · Security Note
• https://osv.dev/vulnerability/GHSA-m7w4-8wp8-m2xq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36442 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0122 · Vendor Advisory
• https://github.com/maciejhirsz/beef/issues/37 · Note
• https://github.com/maciejhirsz/beef · Note
• https://t.me/cvenotify/19525 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2020-0122.html · Note
• https://crates.io/crates/beef · Note
• https://t.me/cibsecurity/26984 · Telegram Post
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/beef/RUSTSEC-2020-0122.md · Note