CVE-2020-25793: Rust Sized-Chunks Package Array Size Check Bypass Vulnerability
Summary
CVE-2020-25791: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From. Affects rust-sized-chunks versions < ebd64cc8a4f417a0df8c3db177fdfe08da96b496. No fix is published. How to fix ↓
Also tracked for
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
The same CVE-2020-25791 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-sized-chunks package is a Rust library designed for efficient handling of chunks of data. It allows developers to work with arrays in a way that optimizes memory usage and performance. However, the package has a vulnerability related to the Chunk implementation, where the array size is not properly validated when constructed from InlineArray, potentially leading to unexpected behavior or crashes.
Vulnerability Detail
An issue was discovered in the sized-chunks crate through version 0.6.2 for Rust. The vulnerability arises from the Chunk implementation, where the size of the array is not checked during construction from InlineArray<A, T>. This oversight can lead to buffer overflows or memory corruption, allowing attackers to exploit the application using this library. The ramifications include potential application crashes or unauthorized access to memory, which can compromise the integrity and security of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation in your application to check the size of arrays before passing them to the sized-chunks library. This can help mitigate the risk until the package is updated.
Conclusion
CVE-2020-25793 represents a significant vulnerability in the rust-sized-chunks package that can lead to serious security issues if not addressed. It is crucial for developers using this package to update to the latest version and implement necessary checks to safeguard their applications.
See every vulnerability recorded for rust-sized-chunks →
FAQ
CVE-2020-25793 is a vulnerability in the rust-sized-chunks package that allows for array size checks to be bypassed, potentially leading to memory corruption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Exploiting this vulnerability can lead to application crashes, memory corruption, and unauthorized access to sensitive data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for rust-sized-chunks.
