CVE-2020-25016 Out of bounds access in rgb
Attackers can exploit unsafe memory handling in the Rust rgb crate to read uninitialized memory or execute arbitrary code via pointer dereferencing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25016?
CVE-2020-25016 is a critical memory corruption vulnerability in n/a, published on 29 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
Which versions are affected by CVE-2020-25016?
3 open source packages ship an affected version, including rgb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rgb crates.io | From 0.5.4 | 0.8.20 |
rgb crates.io | From 0.5.4 | 0.8.20 |
rgb crates.io | From 0.5.4 | 0.8.20 |
Products include Rgb-Rust Project Rgb-Rust.
How do I fix CVE-2020-25016?
Upgrade rgb to 0.8.20 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-25016 being exploited?
There is no known exploitation of CVE-2020-25016 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-25016, GHSA-g4rw-8m5q-6453, RUSTSEC-2020-0029, UBUNTU-CVE-2020-25016.