PT-2020-17632 · Rust · Rcucell

Published 2020-11-14 · Updated 2021-08-25 · CVE-2020-36451

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rcu cell crate through 2020-11-14

Description The issue allows users to send T: !Send to other threads while T is enclosed within RcuCell<T>, and allows users to concurrently access T: !Sync by using the APIs of RcuCell<T> that provide access to &T. This can result in memory corruption caused by data races.

Recommendations For versions of the rcu cell crate through 2020-11-14, consider restricting the use of RcuCell<T> to prevent sending T: !Send to other threads and concurrently accessing T: !Sync until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Race Condition

Weakness Enumeration

CWE-77

CWE-362

Related Identifiers

CVE-2020-36451

GHSA-686H-J8R8-WMFM

RUSTSEC-2020-0131

Affected Products

Rcucell

References · 11

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0131.html · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2020-0131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36451 · Security Note
• https://osv.dev/vulnerability/GHSA-686h-j8r8-wmfm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36451 · Vendor Advisory
• https://github.com/Xudong-Huang/rcu_cell/pull/4/commits/1faf18eee11f14969b77ae0f76dcd9ebd437d0c2 · Note
• https://github.com/Xudong-Huang/rcu_cell · Note
• https://github.com/Xudong-Huang/rcu_cell/pull/4 · Note
• https://github.com/Xudong-Huang/rcu_cell/issues/3 · Note
• https://crates.io/crates/rcu_cell · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rcu_cell/RUSTSEC-2020-0131.md · Note