Vulnerability Description
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rgb-Rust Project | Rgb-Rust | < 0.8.20 |
Related Weaknesses (CWE)
References
- https://github.com/kornelski/rust-rgb/issues/35ExploitThird Party Advisory
- https://rustsec.org/advisories/RUSTSEC-2020-0029.htmlVendor Advisory
- https://github.com/kornelski/rust-rgb/issues/35ExploitThird Party Advisory
- https://rustsec.org/advisories/RUSTSEC-2020-0029.htmlVendor Advisory
FAQ
What is CVE-2020-25016?
CVE-2020-25016 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because struc...
How severe is CVE-2020-25016?
CVE-2020-25016 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-25016?
Check the references section above for vendor advisories and patch information. Affected products include: Rgb-Rust Project Rgb-Rust.