CVE-2020-25794: Memory Safety Issue in rust-sized-chunks Package
Summary
CVE-2020-25791: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic. Affects rust-sized-chunks versions < ebd64cc8a4f417a0df8c3db177fdfe08da96b496. No fix is published. How to fix ↓
Also tracked for
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
The same CVE-2020-25791 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-sized-chunks package is a Rust crate designed for handling collections of data in fixed-size chunks. It is widely used in applications that require efficient data processing and manipulation. However, the package has been identified to have a vulnerability that can lead to memory safety issues, particularly in its Chunk implementation.
Vulnerability Detail
CVE-2020-25794 is a memory-safety vulnerability found in the rust-sized-chunks crate up to version 0.6.2. The issue arises during the clone operation within the Chunk implementation, where a panic can lead to unsafe memory access. This can potentially allow an attacker to exploit the application, leading to data corruption or crashes. The vulnerability is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not possible, consider implementing additional error handling around the clone operations in your application to mitigate the risk of panic. This can help prevent unsafe memory access until the package is updated.
Conclusion
CVE-2020-25794 represents a significant memory safety issue within the rust-sized-chunks package that can lead to potential exploitation. Users are strongly advised to update to version 0.6.5-1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for rust-sized-chunks →
FAQ
CVE-2020-25794 is a vulnerability in the rust-sized-chunks package that can lead to memory safety issues during clone operations.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability has a CVSS score of 7.5, indicating a high severity level that requires prompt attention.
Implement additional error handling around clone operations to mitigate risks until you can update the package.
You can find more information about the rust-sized-chunks package on its GitHub repository or through the Rust documentation.
Related vulnerabilities
Recent vulnerabilities recorded for rust-sized-chunks.
