PT-2020-17656 · Rust · Bite Crate

Published 2020-12-31 · Updated 2022-06-16 · CVE-2020-36511

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions bite crate through 2020-12-31

Description The issue concerns the read::BiteReadExpandedExt::read framed max function, which may read from uninitialized memory locations. This occurs when affected versions of the crate call a user-provided Read implementation on an uninitialized buffer. In Rust, Read on an uninitialized buffer is defined as undefined behavior.

Recommendations For the bite crate through 2020-12-31, consider restricting the use of the read framed max function until a fix is available. As a temporary workaround, avoid using the read::BiteReadExpandedExt::read framed max function to prevent potential issues with uninitialized memory locations. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2020-36511

GHSA-72R2-RG28-47V9

GHSA-V2CH-FC8F-QM33

RUSTSEC-2020-0153

Affected Products

Bite Crate

References · 10

• https://osv.dev/vulnerability/RUSTSEC-2020-0153 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-72r2-rg28-47v9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36511 · Security Note
• https://osv.dev/vulnerability/GHSA-v2ch-fc8f-qm33 · Vendor Advisory
• https://github.com/hinaria/bite · Note
• https://github.com/hinaria/bite/issues/1 · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/bite/RUSTSEC-2020-0153.md · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0153.html · Note
• https://crates.io/crates/bite · Note