CVE-2020-25796: Unaligned Reference Vulnerability in rust-sized-chunks Package
Summary
CVE-2020-25791: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. Affects rust-sized-chunks versions < ebd64cc8a4f417a0df8c3db177fdfe08da96b496. No fix is published. How to fix ↓
Also tracked for
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
The same CVE-2020-25791 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-sized-chunks package is a Rust crate designed to efficiently handle and manipulate chunks of data in a memory-safe manner. It provides an InlineArray implementation that allows for optimized storage and retrieval of data. However, this package has been found to be vulnerable to an issue that can lead to the generation of unaligned references for types with large alignment requirements, potentially causing undefined behavior in applications that rely on this functionality.
Vulnerability Detail
CVE-2020-25796 arises from an implementation flaw in the InlineArray structure of the sized-chunks crate. When the crate is used, it may generate unaligned references for certain data types that require strict alignment. This misalignment can lead to crashes or unexpected behavior in applications, especially those that perform low-level memory operations. The vulnerability affects versions of the package up to 0.6.2, and it has been identified as having a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to avoid using the InlineArray implementation for types that have large alignment requirements. Instead, consider using alternative data structures that do not exhibit this vulnerability until an upgrade can be performed.
Conclusion
CVE-2020-25796 is a significant vulnerability in the rust-sized-chunks package that can lead to serious application issues due to unaligned references. Users are strongly encouraged to upgrade to the latest version to mitigate the risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software.
See every vulnerability recorded for rust-sized-chunks →
FAQ
CVE-2020-25796 is a vulnerability in the rust-sized-chunks package that can lead to the generation of unaligned references for types with large alignment requirements.
The vulnerability can cause crashes or undefined behavior in applications that rely on the affected package, particularly those performing low-level memory operations.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to install anything.
Versions of rust-sized-chunks up to 0.6.2 are affected by this vulnerability. It is recommended to upgrade to version 0.6.5-1 or later.
Detailed information about CVE-2020-25796 can be found in the official CVE database and on the GitHub repository for the sized-chunks crate.
Related vulnerabilities
Recent vulnerabilities recorded for rust-sized-chunks.
