CVE-2020-35887
📋 TL;DR
This vulnerability in the arr crate for Rust allows attackers to trigger buffer overflow conditions through Index and IndexMut operations. It affects any Rust application using vulnerable versions of the arr crate, potentially leading to arbitrary code execution or application crashes.
💻 Affected Systems
- Rust applications using arr crate
📦 What is this software?
Arr by Arr Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes (denial of service) or memory corruption leading to unpredictable behavior.
If Mitigated
Application crashes without code execution if memory protections like ASLR are effective.
🎯 Exploit Status
Exploitation requires crafting specific inputs to trigger buffer overflow via Index/IndexMut operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: arr crate version after 2020-08-25
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0034.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to use arr crate version > 0.8.0
2. Run 'cargo update'
3. Rebuild and redeploy application
4. Restart affected services
🔧 Temporary Workarounds
Remove arr crate dependency
allReplace arr crate functionality with alternative implementations
cargo remove arr
cargo build --release
🧯 If You Can't Patch
- Implement input validation and bounds checking for all array operations
- Deploy memory protection mechanisms (ASLR, DEP) and monitor for crashes
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock for arr crate version <= 0.8.0 or run 'cargo tree | grep arr'Check Version:
grep arr Cargo.lock | head -1Verify Fix Applied:
Verify arr crate version > 0.8.0 in Cargo.lock and test array operations with boundary inputs📡 Detection & Monitoring
Log Indicators:
- Application segmentation faults
- Rust panic messages related to array bounds
- Memory access violation logs
Network Indicators:
- Unusual traffic patterns to services using arr crate
- Repeated connection attempts followed by service crashes
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "panic" OR "array index out of bounds")