An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8118-1 advisory.

    Yechan Bae discovered that sized-chunks did not properly validate array size when constructing Chunk. An     attacker could possibly use these issues to cause out-of-bounds access, leading to memory corruption or     undefined behavior. (CVE-2020-25791, CVE-2020-25792, CVE-2020-25793)

    Yechan Bae discovered that sized-chunks had a memory safety issue in the clone implementation when a panic     occurs. An attacker could possibly use this issue to cause improper memory handling, leading to memory     corruption or a denial of service. (CVE-2020-25794)

    Yechan Bae discovered that sized-chunks could create unaligned references in the InlineArray     implementation for types with strict alignment requirements. An attacker could possibly use this issue to     cause undefined behavior, leading to memory corruption or a denial of service. (CVE-2020-25796)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation,     clone can have a memory-safety issue upon a panic. (CVE-2020-25794)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the rust package has been released.

ID	Name	Product	Family	Type	Severity
303749	Ubuntu 20.04 LTS : sized-chunks vulnerabilities (USN-8118-1)	Nessus	Ubuntu Local Security Checks	Local	high
229915	Linux Distros Unpatched Vulnerability : CVE-2020-25794	Nessus	Misc.	Local	high
203939	Photon OS 3.0: Rust PHSA-2022-3.0-0358	Nessus	PhotonOS Local Security Checks	Local	medium

Detections

Analytics

CVE-2020-25794

high

Tenable Plugins

high

high

medium