PT-2021-12001 · Rust+6 · Rust+6
Skifire13
·
Published
2021-01-12
·
Updated
2022-04-28
·
CVE-2020-36317
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Rust versions prior to 1.49.0
Description:
The issue is related to a panic safety problem in the
String::retain() function. This function allows the creation of a non-UTF-8 Rust string when the provided closure panics, potentially resulting in a memory safety violation. This violation can occur when other string APIs assume that UTF-8 encoding is used on the same string.Recommendations:
For versions prior to 1.49.0, update to version 1.49.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the
String::retain() function until a patch is available. Restrict access to string APIs that assume UTF-8 encoding to minimize the risk of exploitation.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Debian
Red Hat
Rocky Linux
Rust