CVE-2020-35922

MEDIUM5.5EPSS 0.07%

`mio` invalidly assumes the memory layout of std::net::SocketAddr

發布日:2021/8/25修改日:2023/11/8

也稱為:GHSA-pf3p-x6qj-6j7qRUSTSEC-2020-0081

描述

The [`mio`](https://crates.io/crates/mio) crate has assumed `std::net::SocketAddrV4` and `std::net::SocketAddrV6` have the same memory layout as the system C representation `sockaddr`. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens.

受影響套件(2)

crates.io/mio>= 0.7.0, < 0.7.6
crates.io/mio>= 0.7.0, < 0.7.6

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-35922
PATCHhttps://crates.io/crates/mio
PATCHhttps://github.com/tokio-rs/mio
WEBhttps://github.com/tokio-rs/mio/commit/152e0751f0be1c9b0cbd6778645b76bcb0eba93c
WEBhttps://github.com/tokio-rs/mio/issues/1386
WEBhttps://github.com/tokio-rs/mio/pull/1388
WEBhttps://rustsec.org/advisories/RUSTSEC-2020-0081.html