CVE-2020-36465 Use after free in generic-array

High 7.5 Published 8 Aug 2021 Updated 4 Aug 2024

A soundness violation in the generic-array crate allows memory corruption via lifetime extension, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-36465?

CVE-2020-36465 is a high-severity memory corruption vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes.

Which versions are affected by CVE-2020-36465?

11 open source packages ship an affected version, including generic-array. It affects 1 product.

Package	Affected	Fixed in
`generic-array` crates.io	From `0.10.0`	`0.10.1`
`generic-array` crates.io	From `0.10.0`	`0.10.1`
`generic-array` crates.io	From `0.11.0`	`0.11.2`
`generic-array` crates.io	From `0.11.0`	`0.11.2`
`generic-array` crates.io	From `0.12.0`	`0.12.4`
`generic-array` crates.io	From `0.12.0`	`0.12.4`

5 more packages

`generic-array` crates.io	From `0.13.0`	`0.13.3`
`generic-array` crates.io	From `0.13.0`	`0.13.3`
`generic-array` crates.io	From `0.8.0`	`0.8.4, 0.9.1, 0.10.1, 0.11.2, 0.12.4, 0.13.3`
`generic-array` crates.io	From `0.8.0`	`0.9.1`
`generic-array` crates.io	From `0.8.0`	`0.9.1`

Products include Generic-Array Project Generic-Array.

How do I fix CVE-2020-36465?

Upgrade generic-array to a fixed version for your release line: 0.10.1, 0.11.2, 0.12.4 or 0.13.3.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-36465 being exploited?

There is no known exploitation of CVE-2020-36465 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2020-36465, GHSA-3358-4f7f-p4j4, RUSTSEC-2020-0146, UBUNTU-CVE-2020-36465.