PT-2020-17638 · Rust · Lever

Published 2020-11-10 · Updated 2022-11-16 · CVE-2020-36457

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lever crate versions prior to 0.1.1

Description The issue concerns the implementation of the Send and Sync traits for all types T by AtomicBox, which is designed for use across threads. This implementation allows non-Send types, such as Rc, and non-Sync types, such as Cell, to be used across thread boundaries. As a result, it can trigger undefined behavior and memory corruption.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of AtomicBox<T> with non-Send types like Rc and non-Sync types like Cell until the update is applied.

Exploit

Fix

Command Injection

Race Condition

Weakness Enumeration

CWE-77

CWE-362

Related Identifiers

CVE-2020-36457

GHSA-9PP4-8P8V-G78W

RUSTSEC-2020-0137

Affected Products

Lever

References · 11

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0137.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36457 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36457 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0137 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9pp4-8p8v-g78w · Vendor Advisory
• https://github.com/vertexclique/lever/commit/4a4cca61cdb25061967d58522229e147483007b1 · Note
• https://github.com/vertexclique/lever/pull/17 · Note
• https://github.com/vertexclique/lever · Note
• https://github.com/vertexclique/lever/issues/15 · Note
• https://crates.io/crates/lever · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/lever/RUSTSEC-2020-0137.md · Note