CVE-2020-26235 : What You Need to Know

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local, and time::OffsetDateTime::try_now_local. Non-Unix targets like Windows and wasm are unaffected. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.

Understanding CVE-2020-26235

This CVE describes a segmentation fault vulnerability in the Rust time crate affecting specific versions.

What is CVE-2020-26235?

The CVE-2020-26235 vulnerability in the Rust time crate can lead to a segfault on unix-like systems due to a dangling pointer dereference issue.

The Impact of CVE-2020-26235

The impact of this vulnerability is rated as MEDIUM with a CVSS base score of 5.3. It requires low privileges to exploit and can result in high availability impact.

Technical Details of CVE-2020-26235

This section provides technical details of the CVE.

Vulnerability Description

The vulnerability arises from dereferencing a dangling pointer in specific functions of the time crate, leading to a segfault on unix-like systems.

Affected Systems and Versions

Affected versions: >= 0.2.7, < 0.2.23
Systems: Unix-like operating systems

Exploitation Mechanism

The vulnerability can be exploited by setting any environment variable in a different thread than the affected functions, triggering a segfault.

Mitigation and Prevention

Protect your systems from CVE-2020-26235 with the following steps:

Immediate Steps to Take

Update the time crate to version 0.2.23 or later to apply the fix.
Avoid setting environment variables in threads with the affected functions.

Long-Term Security Practices

Regularly update dependencies to ensure you are using the latest secure versions.
Implement secure coding practices to prevent similar vulnerabilities.

Patching and Updates

Stay informed about security advisories and updates related to the Rust time crate.