CVE-2020-35881

The traitobject crate for Rust contains an unsoundness vulnerability due to its incorrect assumptions about the memory layout of fat pointers (trait objects). The data and data_mut functions directly transmute a pointer to a trait object to extract the data pointer, assuming the first field of the fat pointer is always the data pointer [1][2][4]. This assumption is not guaranteed by the Rust compiler and can change across Rust versions, potentially leading to memory corruption.

The vulnerability can be exploited without authentication or user interaction over a network. An attacker could craft inputs that trigger the unsafe transmute, causing the crate to misinterpret memory and read or write arbitrary data [2]. The issue affects all versions of traitobject up to (and including) the version published on 2020-06-01.

Successful exploitation can result in complete compromise of confidentiality, integrity, and availability, with a CVSS score of 9.8 (Critical) [2]. The RustSec advisory identifies this as an unsoundness vulnerability in the memory-corruption category [2].

As of the advisory publication date, no patched version has been released. A fix was committed to the repository (commit 99b1993), but it was not published to crates.io [2][3][4]. Users are advised to avoid using the crate or to apply the fix manually. The crate appears to be unmaintained.