Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-15254

CVE-2020-15254: crossbeam-channel Undefined Behavior before v0.4.4

8.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-15254
GHSA ID
GHSA-v5m7-53cv-f3hx
EPSS Score
0.65412%
CWE
CWE-119
Published
8/25/2021
Updated
6/13/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
crossbeam-channelrust= 0.4.30.4.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the destructor of the bounded channel (array::Channel) incorrectly reconstructing a Vec using the element count as capacity. The implementation assumed Vec::from_iter's capacity matches element count, but this isn't guaranteed. When dropping, it used from_raw_parts with length==capacity, leading to incorrect deallocation. The fix in 0.4.4 replaced Vec with Box<[T]> which guarantees exact allocation size, confirming the vulnerable code was in Channel's destructor handling.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *****t** v*rsion o* t*is *r*t*'s t** `*oun***` ***nn*l in*orr**tly *ssum*s t**t `V**::*rom_it*r` **s *llo**t** **p**ity t**t s*m* *s t** num**r o* it*r*tor *l*m*nts. `V**::*rom_it*r` *o*s not **tu*lly *u*r*nt** t**t *n* m*y *llo**t* *

Reasoning

T** vuln*r**ility st*ms *rom t** **stru*tor o* t** *oun*** ***nn*l (*rr*y::***nn*l) in*orr**tly r**onstru*tin* * V** usin* t** *l*m*nt *ount *s **p**ity. T** impl*m*nt*tion *ssum** V**::*rom_it*r's **p**ity m*t***s *l*m*nt *ount, *ut t*is isn't *u*r*