CVE-2020-35885
📋 TL;DR
This vulnerability in the alpm-rs Rust crate allows double-free memory corruption due to improper deallocation in StrcCtx. Attackers can exploit this to execute arbitrary code or cause denial of service. Any Rust application using vulnerable versions of alpm-rs is affected.
💻 Affected Systems
- alpm-rs Rust crate
📦 What is this software?
Alpm Rs by Alpm Rs Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or denial of service, potentially allowing privilege escalation in multi-user environments.
If Mitigated
Controlled crash with minimal impact if proper memory isolation and privilege separation are implemented.
🎯 Exploit Status
Memory corruption vulnerabilities typically require specific conditions to trigger but can be exploited without authentication if the application processes external input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2020-08-20
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0032.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to use alpm-rs version > 0.8.0. 2. Run 'cargo update'. 3. Rebuild and redeploy your application. 4. Restart affected services.
🔧 Temporary Workarounds
Remove alpm-rs dependency
allTemporarily remove or replace the alpm-rs crate with alternative functionality
cargo remove alpm-rs
🧯 If You Can't Patch
- Isolate affected applications in containers or VMs with minimal privileges
- Implement network segmentation to limit attack surface and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock for alpm-rs version <= 0.8.0 or run 'cargo audit'Check Version:
grep -A2 'name = "alpm-rs"' Cargo.lockVerify Fix Applied:
Verify Cargo.lock shows alpm-rs version > 0.8.0 and 'cargo audit' reports no vulnerabilities📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory allocation errors
- Unexpected process termination
Network Indicators:
- Unusual outbound connections from Rust applications
- Exploit kit traffic patterns
SIEM Query:
process_name:rust AND (event_type:crash OR memory_violation)