PT-2020-17629 · Rust · Kekbit

Published 2020-12-18 · Updated 2021-08-25 · CVE-2020-36449

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kekbit crate versions prior to 0.3.4

Description The issue allows users to send H: !Send to other threads, which can potentially lead to data races and undefined behavior. This is because Send is implemented for ShmWriter<H> without requiring H: Send.

Recommendations For versions prior to 0.3.4, update to version 0.3.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of ShmWriter<H> to prevent sending H: !Send to other threads until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-36449

GHSA-G83M-67WH-WHPW

RUSTSEC-2020-0129

Affected Products

Kekbit

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0129.html · Exploit
• https://osv.dev/vulnerability/GHSA-g83m-67wh-whpw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36449 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0129 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36449 · Vendor Advisory
• https://github.com/motoras/kekbit/issues/34 · Note
• https://github.com/motoras/kekbit · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/kekbit/RUSTSEC-2020-0129.md · Note
• https://crates.io/crates/kekbit · Note
• https://t.me/cibsecurity/26971 · Telegram Post