PT-2020-17636 · Rust · Slock

Published 2020-11-17 · Updated 2021-08-25 · CVE-2020-36455

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions slock crate through 2020-11-17

Description The issue concerns the slock crate, where Slock<T> unconditionally implements Send and Sync. This allows sending non-Send types to other threads, which can lead to data races and memory corruption due to the data race.

Recommendations For versions of the slock crate through 2020-11-17, consider restricting the use of Slock<T> to prevent sending non-Send types to other threads until a fix is available. As a temporary workaround, avoid using Slock<T> with non-Send types to minimize the risk of data races and memory corruption.

Exploit

Fix

Command Injection

Race Condition

Weakness Enumeration

CWE-77

CWE-362

Related Identifiers

CVE-2020-36455

GHSA-83R8-P8V6-6GFM

GHSA-MC36-5M36-HJH5

RUSTSEC-2020-0135

Affected Products

Slock

References · 11

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0135.html · Exploit
• https://osv.dev/vulnerability/GHSA-mc36-5m36-hjh5 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36455 · Security Note
• https://osv.dev/vulnerability/GHSA-83r8-p8v6-6gfm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36455 · Vendor Advisory
• https://github.com/BrokenLamp/slock-rs · Note
• https://github.com/BrokenLamp/slock-rs/commit/719df35f55b6cab4ca2a7f840347a06ecbd8aac6 · Note
• https://github.com/BrokenLamp/slock-rs/issues/2 · Note
• https://crates.io/crates/slock · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/slock/RUSTSEC-2020-0135.md · Note