CVE-2020-36511

Vulnerability

The bite crate through 2020-12-31 for Rust contains an unsoundness issue in the BiteReadExpandedExt::read_framed_max method [1][3]. The function creates a Vec with uninitialized memory using Vec::with_capacity and then passes a slice of that uninitialized memory to a user-provided Read::read_exact implementation [4]. According to the Rust documentation, calling read with an uninitialized buffer is not safe and can lead to undefined behavior [4]. No patched versions are available at this time [3].

Exploitation

An attacker does not require any special network position or authentication; the vulnerability is triggered whenever any code uses the read_framed_max method on a type implementing Read. The attacker must control or influence the Read implementation that is passed to the method. The unsafe code in read_framed_max passes a mutable slice of uninitialized memory to read_exact, which is the user's Read::read implementation. If that implementation reads from the buffer before writing to it (or otherwise inspects the uninitialized contents), undefined behavior occurs [4]. The specific sequence is: the method reads a length from the stream, allocates a Vec with that capacity, creates a slice from the uninitialized memory, then calls self.read_exact(slice), which invokes the user's Read implementation on that uninitialized buffer [4].

Impact

Successful exploitation allows an attacker to cause undefined behavior, typically resulting in reading from uninitialized memory locations. This can lead to information disclosure (exposing sensitive data that was previously stored in memory) and potentially further memory corruption depending on the compiler's optimization decisions [1][3]. The vulnerability is classified as unsound, meaning it violates Rust's safety guarantees and can lead to memory exposure [3].

Mitigation

No patched versions exist for the bite crate [3]. The RustSec advisory lists no patched versions and marks the crate as having no fix [3]. Users should avoid using the read_framed_max method on untrusted or user-provided Read implementations. As a workaround, consider using a different crate that handles buffer initialization safely. The crate is not listed on the CISA KEV (as of the advisory date).