CVE-2020-36434
📋 TL;DR
This vulnerability in the sys-info Rust crate before version 0.8.0 allows attackers to trigger a double free condition when calling sys_info::disk_info. This can lead to memory corruption, crashes, or potentially arbitrary code execution. Any Rust application using vulnerable versions of the sys-info crate is affected.
💻 Affected Systems
- Rust applications using sys-info crate
📦 What is this software?
Sys Info by Sys Info Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes, denial of service, or memory corruption leading to unstable behavior.
If Mitigated
Limited impact with proper memory protections and sandboxing, potentially just crashes.
🎯 Exploit Status
Exploitation requires triggering the vulnerable function, which may require specific application conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: sys-info crate version 0.8.0 or later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0100.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require sys-info >= 0.8.0
2. Run 'cargo update sys-info'
3. Rebuild and redeploy your application
4. Restart any running services using the updated application
🔧 Temporary Workarounds
Avoid disk_info calls
allTemporarily remove or disable calls to sys_info::disk_info() in your code
// Comment out or remove sys_info::disk_info() calls in Rust source code
🧯 If You Can't Patch
- Implement strict input validation and sanitization for any data that could reach the vulnerable function
- Deploy application in sandboxed/containerized environments with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for sys-info dependency version < 0.8.0Check Version:
grep 'sys-info' Cargo.lock | grep versionVerify Fix Applied:
Verify sys-info version is >= 0.8.0 in Cargo.lock after update📡 Detection & Monitoring
Log Indicators:
- Application crashes, segmentation faults, memory corruption errors
Network Indicators:
- Unusual traffic patterns to endpoints that might trigger disk_info calls
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "double free" OR "memory corruption")