PT-2020-17653 · Rust · Max7301

Published 2020-12-18 · Updated 2021-08-25 · CVE-2020-36472

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions max7301 crate versions prior to 0.2.0

Description The issue arises from the ImmediateIO and TransactionalIO types implementing Sync for all contained Expander<EI> types, regardless of whether the Expander itself is safe to use across threads. This can lead to non-thread-safe types being sent across threads as part of the Expander, resulting in data races.

Recommendations For max7301 crate versions prior to 0.2.0, consider updating to version 0.2.0 or later to resolve the issue. As a temporary workaround, avoid using the ImmediateIO and TransactionalIO types across threads to minimize the risk of data races. Restrict access to the Expander types to ensure they are not sent across threads, leading to potential data corruption.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2020-36472

GHSA-RMFF-F8W9-C9RM

RUSTSEC-2020-0152

Affected Products

Max7301

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2020-0152.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36472 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2020-0152 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rmff-f8w9-c9rm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36472 · Vendor Advisory
• https://github.com/edarc/max7301/issues/1 · Note
• https://github.com/edarc/max7301/commit/0a1da873ddb29bca926bad8301f8d7ab8aa97c52 · Note
• https://github.com/edarc/max7301 · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/max7301/RUSTSEC-2020-0152.md · Note
• https://crates.io/crates/max7301 · Note