CVE-2020-26235 Segmentation fault in Rust time crate
A dangling pointer dereference in the Rust time crate causes segmentation faults on Unix systems when environment variables are modified concurrently.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26235?
CVE-2020-26235 is a medium-severity vulnerability in time-rs time, published on 24 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.
Weakness: CWE-476
Which versions are affected by CVE-2020-26235?
6 open source packages ship an affected version, including time and chrono. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
time crates.io | From 0.0.0-0 | 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.23 |
time crates.io | From 0.1.0 | 0.2.23 |
time crates.io | From 0.1.0 | 0.2.23 |
time crates.io | From 0.2.7 | 0.2.23 |
time crates.io | From 0.2.7 | 0.2.23 |
chrono crates.io | From 0.0.0-0 | 0.4.20 |
Products include Time Project Time.
How do I fix CVE-2020-26235?
Upgrade time to a fixed version for your release line: 0.2.0, 0.2.1, 0.2.2 or 0.2.3.
Is CVE-2020-26235 being exploited?
There is no known exploitation of CVE-2020-26235 in the wild and no public exploit code.
Other vulnerabilities in time-rs time
Sources
Also known as GHSA-wcg3-cvx6-7396, RUSTSEC-2020-0071, RUSTSEC-2020-0159, UBUNTU-CVE-2020-26235, openSUSE-SU-2024:12746-1.