CVE-2020-36323 Information disclosure in n/a
An optimization flaw in Rust's string joining can expose uninitialized memory or crash the program if the input string changes during processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36323?
CVE-2020-36323 is a high-severity vulnerability in Fedoraproject Fedora, published on 14 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
Weakness: CWE-134
Which versions are affected by CVE-2020-36323?
It affects 2 products.
Products include Fedoraproject Fedora, Rust-Lang Rust.
How do I fix CVE-2020-36323?
Upgrade to a fixed version.
Is CVE-2020-36323 being exploited?
There is no known exploitation of CVE-2020-36323 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2020-36323, CLEANSTART-2026-TK31372, DEBIAN-CVE-2020-36323, GHSA-9v8g-q8xx-7374, UBUNTU-CVE-2020-36323.