PT-2020-17631 · Rust · Bunch

Published

2020-11-12

·

Updated

2021-08-25

·

CVE-2020-36450

CVSS v3.1

8.1

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions bunch crate versions through 2020-11-12
Description The issue concerns unconditional implementations of Send and Sync for Bunch<T>. This allows users to insert T: !Sync to Bunch<T>, potentially creating a data race by invoking the Bunch::get() API from multiple threads. It is also possible to send T: !Send to other threads by inserting T inside Bunch<T> and sending Bunch<T> to another thread, allowing to create a data race by inserting types like T = Rc< >. Such data races can lead to memory corruption.
Recommendations As a temporary workaround, consider restricting the use of the Bunch<T> crate until a patch is available. Avoid using the Bunch::get() API from multiple threads to minimize the risk of exploitation. Restrict access to the Bunch<T> crate to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Race Condition

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2020-36450
GHSA-JWPH-QP5H-F9WJ
RUSTSEC-2020-0130

Affected Products

Bunch