Reported

January 30, 2020

Issued

October 1, 2020 (last modified: June 13, 2023)

Package

actix-codec (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Aliases

• CVE-2020-35902
• GHSA-rqgx-hpg4-456r

References

• https://github.com/actix/actix-net/issues/91

CVSS Score

9.8 CRITICAL

CVSS Details

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality Impact

High

Integrity Impact

High

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patched

• >=0.3.0-beta.1

Description

Affected versions of this crate did not require the buffer wrapped in Framed to be pinned, but treated it as if it had a fixed location in memory. This may result in a use-after-free.

The flaw was corrected by making the affected functions accept Pin<&mut Self> instead of &mut self.

Advisory available under CC0-1.0 license.