PT-2020-17640 · Rust · Dces Crate

Published 2020-12-09 · Updated 2021-08-25 · CVE-2020-36459

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dces crate versions through 2020-12-09

Description An issue was discovered in the dces crate where the World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. This allows non-thread safe EntityStore and ComponentStores to be sent across threads and cause data races.

Recommendations For versions through 2020-12-09, consider restricting the use of the World type to prevent sending non-thread safe EntityStore and ComponentStores across threads until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Race Condition

Weakness Enumeration

CWE-77

CWE-362

Related Identifiers

CVE-2020-36459

GHSA-HXW9-JXQW-JC8J

RUSTSEC-2020-0139

Affected Products

Dces Crate

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0139.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36459 · Security Note
• https://osv.dev/vulnerability/GHSA-hxw9-jxqw-jc8j · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0139 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36459 · Vendor Advisory
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/dces/RUSTSEC-2020-0139.md · Note
• https://gitlab.redox-os.org/redox-os/dces-rust/-/issues/8 · Note
• https://gitlab.redox-os.org/redox-os/dces-rust · Note
• https://t.me/cvenotify/19511 · Telegram Post
• https://crates.io/crates/dces · Note