CVE-2020-35904 — Incorrect Calculation of Buffer Size in Project Crossbeam-channel

CWE-131 — Incorrect Calculation of Buffer Size7 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 82.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Crossbeam-channel Project Crossbeam-channelDebian Rust-crossbeam-channel
Timeline
PublishedDec 31
Latest updateAug 25

Description

An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/rust-crossbeam-channel< rust-crossbeam-channel 0.4.4-1 (bookworm)

Patches

Patch: rustsec.org ↗Patch: rustsec.org ↗

🔴Vulnerability Details

5
OSV
crossbeam-channel Undefined Behavior before v0.4.4↗2021-08-25
▶
GHSA
Incorrect buffer size in crossbeam-channel↗2021-08-25
▶
OSV
Incorrect buffer size in crossbeam-channel↗2021-08-25
▶
OSV
CVE-2020-35904: An issue was discovered in the crossbeam-channel crate before 0↗2020-12-31
▶
OSV
Undefined Behavior in bounded channel↗2020-06-26
▶

📋Vendor Advisories

1
Debian
CVE-2020-35904: rust-crossbeam-channel - An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It...↗2020
▶