HistoryEdit

RUSTSEC-2020-0089

nanorand 0.5.0 - RNGs failed to generate properly for non-64-bit numbers

Reported
Issued
Package
nanorand (crates.io)
Type
Vulnerability
Categories
Keywords
#rng
Aliases
Details
https://twitter.com/aspenluxxxy/status/1336684692284772352
CVSS Score
5.1 MEDIUM
CVSS Details
Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Patched
  • >=0.5.1

Description

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion.

This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator..