critical9.8
CVE-2020-25576
Unaligned memory access in rand_core
Impact
### Impact Affected versions of this crate violated alignment when casting byte slices to integer slices, resulting in undefined behavior. `rand_core::BlockRng::next_u64` and `rand_core::BlockRng::fill_bytes` are affected. ### Patches The flaw was corrected by Ralf Jung and Diggory Hardy for `rand_core >= 0.4.2`. ### Workarounds None. ### References See [Rand's changelog](https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06). ### For more information If you have any questions or comments about this advisory, [open an issue in the Rand repository](https://github.com/rust-random/rand/issues/new/choose).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | rand_core | >= 0.4.0, < 0.4.2 | 0.4.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rust-Random | Rand | before 0.4.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://rustsec.org/advisories/RUSTSEC-2019-0035.html
- https://github.com/advisories/GHSA-mmc9-pwm7-qj5w
- https://github.com/rust-random/rand/security/advisories/GHSA-mmc9-pwm7-qj5w
- https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06