PT-2020-17646 · Rust · Heapless

Published 2020-11-02 · Updated 2021-08-25 · CVE-2020-36464

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions heapless crate versions prior to 0.6.1

Description The issue arises from the IntoIter Clone implementation, which clones the entire underlying Vec without considering whether it has already been partially consumed. This can lead to a use-after-free access if the iterator is partially consumed, as the consumed items will be copied. A proof of concept is available, demonstrating the potential for exploitation.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Clone implementation on partially consumed IntoIter instances to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2020-36464

GHSA-QGWF-R2JJ-2CCV

RUSTSEC-2020-0145

Affected Products

Heapless

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0145.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-36464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36464 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0145 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qgwf-r2jj-2ccv · Vendor Advisory
• https://github.com/japaric/heapless · Note
• https://github.com/japaric/heapless/issues/181 · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/heapless/RUSTSEC-2020-0145.md · Note
• https://t.me/cibsecurity/26983 · Telegram Post
• https://crates.io/crates/heapless · Note