CVE-2020-35858
📋 TL;DR
This vulnerability in the prost Rust crate allows attackers to cause stack exhaustion via specially crafted messages, leading to denial of service. In worst-case scenarios on ARM architectures, it could potentially enable remote code execution. Any Rust application using vulnerable versions of the prost crate is affected.
💻 Affected Systems
- prost Rust crate
📦 What is this software?
Prost by Prost Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on ARM architectures, allowing complete system compromise.
Likely Case
Denial of service through stack exhaustion, crashing affected applications.
If Mitigated
Limited impact with proper input validation and memory protections in place.
🎯 Exploit Status
Exploitation requires sending specially crafted messages to applications using prost for deserialization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: prost 0.6.1 and later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0002.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require prost >= 0.6.1
2. Run 'cargo update prost'
3. Rebuild and redeploy affected applications
4. Restart services using the updated crate
🔧 Temporary Workarounds
Input validation and size limits
allImplement message size limits and validation before deserialization
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable services
- Deploy WAF or reverse proxy with message size limits and protocol buffer validation
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or run 'cargo tree | grep prost' to see if prost version < 0.6.1 is usedCheck Version:
grep -A2 'name = "prost"' Cargo.lockVerify Fix Applied:
Verify prost version >= 0.6.1 in Cargo.lock after update📡 Detection & Monitoring
Log Indicators:
- Application crashes with stack overflow errors
- Unusual memory consumption patterns
Network Indicators:
- Large or malformed protocol buffer messages to services using prost
SIEM Query:
source="application.logs" AND ("stack overflow" OR "prost" OR "protocol buffer")