CVE-2020-35904

Vulnerability

Overview

The crossbeam-channel crate for Rust, versions prior to 0.4.4, contains a vulnerability in its bounded channel implementation. The root cause is an incorrect assumption about the memory allocation behavior of Vec::from_iter. When the bounded channel is constructed, the code incorrectly assumes that the allocated capacity exactly matches the number of elements passed to the iterator. However, Vec::from_iter may allocate extra capacity, leading to a mismatch between the actual allocation size and the size assumed during deallocation [1][4].

Exploitation

Prerequisites

This vulnerability is triggered when a bounded channel is dropped. Any Rust program that uses a bounded channel (created with crossbeam_channel::bounded) and later drops it is susceptible. No special privileges or network access are required; the issue manifests during normal memory cleanup. The bug is specific to the bounded channel variant and does not affect unbounded channels [4].

Impact

When the channel is dropped, the destructor attempts to deallocate the buffer using the incorrect capacity, resulting in undefined behavior. This can cause memory corruption, crashes, or, as evidenced by a referenced commit, deadlocks in memory allocators such as jemalloc [1]. An attacker who can influence the creation and dropping of bounded channels in a targeted process might leverage the UB to trigger a denial of service or, potentially, more severe consequences depending on the allocator and system state.

Mitigation

The vulnerability is fixed in version 0.4.4 of crossbeam-channel. Users should update to this version or later. No workarounds are documented, and the crate maintainers have resolved the issue by using Box<[T]> to guarantee exact allocation capacity [1][4].