Improper random number generation in nanorand
In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-35926US | critical9.8OT elevated | — | ||
An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishand… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/Absolucy/nanorand-rsPACKAGE
- https://github.com/Absolucy/nanorand-rs/commit/5ba218ac29df4786b002d7d12b47fa0c04a331f2WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-35926ADVISORY
- https://rustsec.org/advisories/RUSTSEC-2020-0089.htmlWEB
- https://twitter.com/aspenluxxxy/status/1336684692284772352WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan