Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-36452

CVE-2020-36452: Memory corruption in array-tools

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-36452
GHSA ID
GHSA-6wp2-fw3v-mfmc
EPSS Score
0.687%
CWE
CWE-908
Published
8/25/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
array-toolsrust< 0.3.20.3.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly identifies FixedCapacityDequeLike<T, A>::clone() as the problematic function. The root cause is insufficient panic safety - when user-provided T::clone() panics during the cloning process, the implementation doesn't properly track initialized elements. This results in the drop handler attempting to destruct uninitialized memory, violating memory safety. The advisory's technical details and CVE description consistently point to this specific function as the vulnerability source.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in t** *rr*y-tools *r*t* ***or* *.*.* *or Rust. *****t** v*rsions o* t*is *r*t* *on't *u*r* ***inst p*ni*s, so t**t p*rti*lly uniniti*liz** *u***r is *ropp** w**n us*r-provi*** `T::*lon*()` p*ni*s in `*ix****p**ity**qu*Lik*<T,

Reasoning

T** vuln*r**ility **s*ription *xpli*itly i**nti*i*s `*ix****p**ity**qu*Lik*<T, *>::*lon*()` *s t** pro*l*m*ti* *un*tion. T** root **us* is insu**i*i*nt p*ni* s***ty - w**n us*r-provi*** `T::*lon*()` p*ni*s *urin* t** *lonin* pro**ss, t** impl*m*nt*ti