PT-2020-17658 · Rust · Acc Reader
Published
2020-12-27
·
Updated
2022-06-16
·
CVE-2020-36513
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
acc reader crate through 2020-12-27
Description
The issue allows arbitrary
Read implementations to read from an uninitialized buffer, resulting in memory exposure. This can also cause the implementations to return an incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values, which can quickly invoke undefined behavior. The functions read up to and fill buf may read from uninitialized memory locations.Recommendations
For acc reader crate through 2020-12-27, consider restricting the use of the
read up to and fill buf functions until a patch is available. Avoid passing uninitialized buffers to user-provided Read implementations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Acc Reader