CVE-2020-36458
📋 TL;DR
This vulnerability in the Rust lexer crate involves an incorrect Sync trait implementation for ReaderResult<T, E> that only requires T: Send and E: Send, rather than T: Sync and E: Sync. This allows data races in concurrent Rust programs using this crate, potentially leading to memory corruption or undefined behavior. Any Rust application using the affected lexer crate versions is vulnerable.
💻 Affected Systems
- lexer crate for Rust
📦 What is this software?
Lexer by Lexer Project
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, denial of service, or data integrity compromise in concurrent Rust applications.
Likely Case
Data races causing application crashes, undefined behavior, or memory safety violations in multi-threaded Rust programs.
If Mitigated
No impact if applications don't use concurrent access to ReaderResult objects or have proper thread synchronization.
🎯 Exploit Status
Exploitation requires crafting concurrent access patterns to trigger the incorrect Sync implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2020-11-10
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2020-0138.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to use lexer crate version > 2020-11-10
2. Run 'cargo update --package lexer'
3. Rebuild and redeploy your Rust application
🔧 Temporary Workarounds
Avoid concurrent ReaderResult access
allEnsure ReaderResult objects are not accessed concurrently across threads
Use thread synchronization
allWrap ReaderResult access in Mutex or other synchronization primitives
🧯 If You Can't Patch
- Implement manual thread synchronization around all ReaderResult usage
- Audit code for concurrent ReaderResult access patterns and eliminate them
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock for lexer crate version <= 0.1.0 (2020-11-10) or run 'cargo tree | grep lexer'Check Version:
grep -A2 'name = "lexer"' Cargo.lockVerify Fix Applied:
Verify lexer crate version > 2020-11-10 in Cargo.lock after update📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Thread panic messages related to data races
Network Indicators:
- None specific - this is a code-level vulnerability
SIEM Query:
Not applicable - this is a compile-time/library vulnerability