CVE-2020-35901
📋 TL;DR
This vulnerability in the actix-http crate for Rust allows attackers to cause a use-after-free condition in the BodyStream component, potentially leading to memory corruption and arbitrary code execution. It affects Rust applications using vulnerable versions of the actix-http crate. The issue stems from improper memory management when handling HTTP request/response bodies.
💻 Affected Systems
- actix-http crate for Rust
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption.
Likely Case
Application crashes, denial of service, or memory corruption leading to unpredictable behavior.
If Mitigated
Limited impact with proper memory safety controls and sandboxing, potentially just crashes.
🎯 Exploit Status
Exploitation requires crafting specific HTTP requests to trigger the use-after-free condition. Public advisories include technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.0-alpha.1 or later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0048.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require actix-http >=2.0.0-alpha.1. 2. Run 'cargo update' to fetch the patched version. 3. Rebuild and redeploy your application. 4. Test thoroughly after update.
🔧 Temporary Workarounds
Downgrade to actix-web 2.0.0
allUse actix-web framework version 2.0.0 which includes the fixed actix-http dependency
cargo update -p actix-web --precise 2.0.0
🧯 If You Can't Patch
- Implement WAF rules to block suspicious HTTP request patterns targeting body streams
- Deploy application behind reverse proxy with request size limits and anomaly detection
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or run 'cargo tree | grep actix-http' to see if version <2.0.0-alpha.1 is presentCheck Version:
cargo tree | grep actix-httpVerify Fix Applied:
Verify actix-http version is >=2.0.0-alpha.1 in Cargo.lock after update📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected segmentation faults in Rust processes
- High memory usage patterns
Network Indicators:
- HTTP requests with malformed or unusually large body content
- Requests triggering abnormal response patterns
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "use-after-free" OR "memory corruption") AND process="rust_app"