PT-2020-17657 · Rust · Buffoon Crate

Published 2020-12-31 · Updated 2022-06-16 · CVE-2020-36512

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions buffoon crate through 2020-12-31

Description The issue allows arbitrary Read implementations to read from an uninitialized buffer, resulting in memory exposure. This can also cause incorrect numbers of bytes to be written to the buffer. Reading from uninitialized memory produces undefined values, which can quickly invoke undefined behavior.

Recommendations For versions of the buffoon crate through 2020-12-31, consider restricting the use of the InputStream::read exact function until a patch is available. As a temporary workaround, avoid passing uninitialized buffers to user-provided Read implementations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2020-36512

GHSA-HMX9-JM3V-33HV

GHSA-V938-QCC9-RWV8

RUSTSEC-2020-0154

Affected Products

Buffoon Crate

References · 10

• https://osv.dev/vulnerability/GHSA-v938-qcc9-rwv8 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36512 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36512 · Security Note
• https://osv.dev/vulnerability/GHSA-hmx9-jm3v-33hv · Vendor Advisory
• https://github.com/carllerche/buffoon · Note
• https://github.com/carllerche/buffoon/issues/2 · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/buffoon/RUSTSEC-2020-0154.md · Note
• https://crates.io/crates/buffoon · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0154.html · Note