CVE-2020-15254: Undefined Behavior in bounded Crossbeam channel
Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that Vec::fromiter has allocated capacity that same as the number of iterator elements. Vec::fromiter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when Vec::fromiter has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.
Other sources
In the crossbeam rust crate, the bounded channel incorrectly assumed that Vec::fromiter had allocated capacity that was the same as the number of iterator elements. Vec::fromiter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumptions - this is unsound and caused a deallocation with the incorrect capacity when Vec::fromiter had allocated different sizes than the number of iterator elements. The impact on Firefox is undetermined, but in another use case, the behavior was causing corruption of jemalloc structures.
Undefined Behavior in bounded Crossbeam channel
— Microsoft
Affected Software
Remediation
Patch Available
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-15254.
What is the severity of CVE-2020-15254?
The severity of CVE-2020-15254 is high.
Which software is affected by CVE-2020-15254?
Mozilla Firefox up to version 82 is affected by CVE-2020-15254.
How can I fix CVE-2020-15254?
To fix CVE-2020-15254, update Mozilla Firefox to version 82 or above.
Where can I find more information about CVE-2020-15254?
You can find more information about CVE-2020-15254 at the following references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1668514), [GitHub Security Advisory](https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-v5m7-53cv-f3hx), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2020-45/).