CVE-2020-36512

Vulnerability

The buffoon crate (versions up to 2020-12-31) contains a soundness vulnerability in InputStream::read_exact. This method creates an uninitialized buffer and passes it directly to a user-provided Read implementation [1][2]. The Rust standard library's Read trait documentation explicitly warns that calling read with an uninitialized buffer is not safe and can lead to undefined behavior [4]. This affects all versions of the crate that were available up to the reported date, and no patched versions have been released [2].

Exploitation

An attacker who can control the Read implementation that gets passed to InputStream::read_exact (for example, when the attacker can provide the data being read or can influence the implementation through other means) can trigger undefined behavior. The attacker's Read implementation can read from the uninitialized buffer, leading to memory exposure, and can also return an incorrect number of bytes written to the buffer, producing undefined values [2]. No special privileges are required beyond the ability to supply a custom Read implementation for the vulnerable method call.

Impact

Successful exploitation results in undefined behavior (UB) due to reading from uninitialized memory. This can lead to information disclosure (memory exposure), and because undefined values can quickly propagate, it may cause a wide range of further impacts including program crashes, data corruption, or potential code execution depending on how the undefined values are used [2]. The vulnerability is classified under the memory-exposure category and is considered unsound (INFO level) by the RustSec advisory database [2].

Mitigation

As of the last update from the advisory database (June 13, 2023), no patched versions of the buffoon crate have been released [2]. The vulnerability was reported on December 31, 2020, and the issue was acknowledged by the maintainers in a GitHub issue [4]. Users are advised to avoid using the buffoon crate or to replace it with an alternative for Protocol Buffers in Rust. The crate does not appear to be actively maintained. No workaround is available within the crate itself. This vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog.