CVE-2020-36318
📋 TL;DR
A double-free vulnerability in Rust's VecDeque::make_contiguous function allows attackers to cause use-after-free or double-free conditions, potentially leading to arbitrary code execution. This affects all applications using Rust standard library versions before 1.49.0. The vulnerability is particularly dangerous because it's in Rust's standard library, affecting many Rust-based projects.
💻 Affected Systems
- Rust programming language standard library
📦 What is this software?
Rust by Rust Lang
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Application crashes, denial of service, or memory corruption leading to data corruption
If Mitigated
Application crashes with minimal data loss if proper memory safety controls are in place
🎯 Exploit Status
Proof of concept exists in GitHub issues. Exploitation requires triggering the specific VecDeque condition, which may be present in various Rust applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Rust 1.49.0 and later
Vendor Advisory: https://github.com/rust-lang/rust/issues/79808
Restart Required: Yes
Instructions:
1. Update Rust toolchain to version 1.49.0 or later using rustup update stable. 2. Recompile all Rust applications with the updated toolchain. 3. Redeploy updated applications. 4. Test applications for compatibility.
🔧 Temporary Workarounds
Avoid VecDeque::make_contiguous
allModify code to avoid using VecDeque::make_contiguous method
// Replace VecDeque::make_contiguous() calls with alternative implementations
Memory safety hardening
linuxEnable additional memory safety features and compile with security flags
RUSTFLAGS="-C link-arg=-Wl,-z,relro,-z,now" cargo build --release
🧯 If You Can't Patch
- Isolate vulnerable applications in containers or VMs with minimal privileges
- Implement network segmentation and restrict access to vulnerable services
🔍 How to Verify
Check if Vulnerable:
Check Rust version with 'rustc --version'. If version is earlier than 1.49.0, check if application uses VecDeque::make_contiguous in source code.Check Version:
rustc --versionVerify Fix Applied:
Verify Rust version is 1.49.0 or later with 'rustc --version'. Test application functionality and run security scans.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Segmentation faults in Rust applications
- Abnormal memory usage patterns
Network Indicators:
- Unexpected application restarts
- Increased error rates in web services
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "double free" OR "use-after-free") AND process="rust_app"