Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-36443

CVE-2020-36443: Use of Uninitialized Resource in libp2p-deflate

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-36443
GHSA ID
GHSA-gvcp-948f-8f2p
EPSS Score
0.61972%
CWE
CWE-908
Published
8/25/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
libp2p-deflaterust< 0.27.10.27.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the poll_read implementation in DeflateOutput's AsyncRead trait. The advisory explicitly states that an uninitialized buffer was passed to AsyncRead::poll_read(), which is a user-provided trait function. The fix involved ensuring buffer initialization before passing it to poll_read, confirming the vulnerability was in this specific AsyncRead implementation. The struct name (DeflateOutput) and trait method (poll_read) are directly implicated in the vulnerability description and subsequent patch information.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in t** li*p*p-***l*t* *r*t* ***or* *.**.* *or Rust. *n uniniti*liz** *u***r is p*ss** to *syn*R***::poll_r***(), w*i** is * us*r-provi*** tr*it *un*tion.

Reasoning

T** vuln*r**ility st*ms *rom t** poll_r*** impl*m*nt*tion in ***l*t*Output's *syn*R*** tr*it. T** **visory *xpli*itly st*t*s t**t *n uniniti*liz** *u***r w*s p*ss** to *syn*R***::poll_r***(), w*i** is * us*r-provi*** tr*it *un*tion. T** *ix involv**