PT-2020-17635 · Rust · Parc Crate

Published 2020-11-14 · Updated 2021-08-25 · CVE-2020-36454

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parc crate through 2020-11-14

Description An issue in the parc crate allows concurrent access to a non-Sync T, which can cause undefined behavior like data races. This is due to LockWeak unconditionally implementing Send without trait bounds on T, despite not owning T and only providing &T.

Recommendations For parc crate through 2020-11-14, consider restricting the use of LockWeak to prevent concurrent access to non-Sync T until a patch is available. As a temporary workaround, ensure that T implements Sync to prevent data races. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-36454

GHSA-29V7-3V4C-GF38

GHSA-XWXC-J97J-84GF

RUSTSEC-2020-0134

Affected Products

Parc Crate

References · 11

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0134.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-36454 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29v7-3v4c-gf38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36454 · Security Note
• https://osv.dev/vulnerability/GHSA-xwxc-j97j-84gf · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0134 · Vendor Advisory
• https://github.com/hyyking/rustracts/tree/master/parc · Note
• https://github.com/hyyking/rustracts/pull/6 · Note
• https://crates.io/crates/parc · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/parc/RUSTSEC-2020-0134.md · Note
• https://t.me/cibsecurity/26989 · Telegram Post