CVE-2020-36445
📋 TL;DR
This vulnerability in the convec Rust crate allows data races and memory corruption by incorrectly marking ConVec<T> as thread-safe (Send and Sync) when it's not. Any Rust application using the affected convec crate versions is vulnerable to undefined behavior including crashes or potential code execution.
💻 Affected Systems
- convec Rust crate
📦 What is this software?
Convec by Project
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, denial of service, or data integrity compromise.
Likely Case
Application crashes, data corruption, or undefined behavior due to data races in concurrent code.
If Mitigated
No impact if application doesn't use convec in concurrent contexts or has proper thread isolation.
🎯 Exploit Status
Exploitation requires the application to use convec in concurrent code paths. The vulnerability is in the library's safety guarantees, not a specific function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 2020-11-24 (crate was yanked from crates.io)
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0125.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to remove convec dependency or use alternative. 2. Run 'cargo update' to sync dependencies. 3. Rebuild and redeploy application. 4. Test thoroughly for any convec usage.
🔧 Temporary Workarounds
Remove convec dependency
allReplace convec usage with standard Rust collections or alternative thread-safe collections
cargo remove convec
cargo update
Isolate convec usage
allEnsure convec is only used in single-threaded contexts with proper synchronization
🧯 If You Can't Patch
- Audit codebase for convec usage and ensure it's never used across thread boundaries
- Implement runtime checks to detect concurrent access to convec instances
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock for 'convec' dependency with version <= 0.1.0 (yanked versions)Check Version:
grep -A2 'name = "convec"' Cargo.lockVerify Fix Applied:
Verify 'cargo tree' shows no convec dependency or shows it's been removed📡 Detection & Monitoring
Log Indicators:
- Segmentation faults
- Memory access violations
- Unexpected panics in concurrent code
Network Indicators:
- None specific - this is a library memory safety issue
SIEM Query:
Application logs containing 'panicked at' or segmentation fault errors in Rust applications