CVE-2020-25576 Unaligned memory access in rand_core
Improper alignment handling in rand_core allows attackers to cause memory corruption, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25576?
CVE-2020-25576 is a critical memory corruption vulnerability in n/a, published on 14 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
Weakness: CWE-704
Which versions are affected by CVE-2020-25576?
5 open source packages ship an affected version, including rand_core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rand_core crates.io | All versions | 0.3.1 |
rand_core crates.io | All versions | 0.3.1 |
rand_core crates.io | From 0.0.0-0 | 0.3.1, 0.4.2 |
rand_core crates.io | From 0.4.0 | 0.4.2 |
rand_core crates.io | From 0.4.0 | 0.4.2 |
Products include Rust-Random Rand.
How do I fix CVE-2020-25576?
Upgrade rand_core to a fixed version for your release line: 0.3.1 or 0.4.2.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-25576 being exploited?
There is no known exploitation of CVE-2020-25576 in the wild and no public exploit code.
Sources
Also known as AZL-46540, DEBIAN-CVE-2020-25576, GHSA-mmc9-pwm7-qj5w, RUSTSEC-2019-0035, UBUNTU-CVE-2020-25576.