PT-2020-17642 · Rust · Model Crate

Published 2020-11-10 · Updated 2021-08-25 · CVE-2020-36460

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions model crate through 2020-11-10

Description An issue was discovered in the Shared data structure, which implements the Send and Sync traits without regard for the inner type. This allows safe Rust code to trigger a data race, which is undefined behavior in Rust. Users are advised to treat Shared as an unsafe type.

Recommendations For model crate through 2020-11-10, users are advised to treat Shared as an unsafe type and not use it outside of the testing context. Care must be taken to ensure that the testing code does not have a data race, besides a race condition that is expected to be caught by the test.

Exploit

Fix

Type Confusion

Race Condition

Weakness Enumeration

CWE-843

CWE-362

Related Identifiers

CVE-2020-36460

GHSA-MXV6-Q98X-H958

RUSTSEC-2020-0140

Affected Products

Model Crate

References · 11

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0140.html · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2020-0140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36460 · Security Note
• https://osv.dev/vulnerability/GHSA-mxv6-q98x-h958 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36460 · Vendor Advisory
• https://github.com/spacejam/model/issues/3 · Note
• https://github.com/spacejam/model · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/model/RUSTSEC-2020-0140.md · Note
• https://t.me/cvenotify/19479 · Telegram Post
• https://crates.io/crates/model · Note
• https://t.me/cibsecurity/26991 · Telegram Post