CVE-2020-35906
📋 TL;DR
This vulnerability in the Rust futures-task crate allows use-after-free memory corruption when handling non-static types in waker functions. Attackers could exploit this to execute arbitrary code or crash applications. Any Rust application using affected versions of the futures-task crate is vulnerable.
💻 Affected Systems
- Rust applications using futures-task crate
📦 What is this software?
Futures Task by Rust Lang
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption.
Likely Case
Application crashes causing denial of service, potentially leading to memory corruption that could be leveraged for further exploitation.
If Mitigated
Limited impact with proper memory safety controls and sandboxing, but still potential for crashes.
🎯 Exploit Status
Exploitation requires specific conditions with non-static types and memory management patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: futures-task 0.3.6 and later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0060.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require futures-task >= 0.3.6
2. Run 'cargo update' to fetch the patched version
3. Rebuild and redeploy your application
4. Restart affected services
🔧 Temporary Workarounds
Avoid non-static types in waker contexts
allRefactor code to avoid using non-static types with futures_task::waker functions
🧯 If You Can't Patch
- Isolate vulnerable applications in containers or sandboxes with limited permissions
- Implement network segmentation to limit attack surface and lateral movement potential
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or run 'cargo tree | grep futures-task' to see if version < 0.3.6 is usedCheck Version:
cargo tree | grep futures-taskVerify Fix Applied:
Verify Cargo.lock contains futures-task >= 0.3.6 and rebuild application successfully📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Segmentation faults in Rust applications
Network Indicators:
- Unusual outbound connections from Rust services
- Service disruption patterns
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "use-after-free" OR "memory corruption") AND process="rust_app"