PT-2020-17624 · Rust · Async-Coap

Published 2020-12-08 · Updated 2021-08-25 · CVE-2020-36444

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions async-coap crate versions through 2020-12-08

Description An issue was discovered in the async-coap crate where Send and Sync are implemented for ArcGuard<RC, T> without trait bounds on RC. This allows users to send RC: !Send to other threads and also allows users to concurrently access RC: !Sync from multiple threads, potentially resulting in memory corruption from data race or other undefined behavior caused by sending T: !Send to other threads.

Recommendations For async-coap crate versions through 2020-12-08, consider restricting the use of ArcGuard<RC, T> to prevent sending RC: !Send to other threads and concurrently accessing RC: !Sync from multiple threads until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-36444

GHSA-9J8Q-M9X5-9G6J

RUSTSEC-2020-0124

Affected Products

Async-Coap

References · 10

• https://osv.dev/vulnerability/CVE-2020-36444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36444 · Security Note
• https://osv.dev/vulnerability/GHSA-9j8q-m9x5-9g6j · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0124 · Vendor Advisory
• https://github.com/google/rust-async-coap/issues/33 · Note
• https://github.com/google/rust-async-coap · Note
• https://crates.io/crates/async-coap · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0124.html · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/async-coap/RUSTSEC-2020-0124.md · Note
• https://t.me/cibsecurity/26993 · Telegram Post