Headline
CVE-2020-25575: Memory safe violation by abusing `__private_get_type_id__` · Issue #336 · rust-lang-deprecated/failure
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce “compatibility hazards” in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010.
I noticed that it is possible to cause type confusion in downcast by manually implementing private_get_type_id.
https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=ad66fe439660eb8373996bfd6bd7a835
Although the name of the function clearly shows that it is a private API, I believe a safe Rust program should not violate the memory safety guaranteed by Rust type system.
Related news
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in the failure crate through 0.1.5 for Rust. It has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.