LiveActive security incident?Get immediate response
CVE Record

CVE-2020-36468: An issue was discovered in the cgc crate through 2020-12-10 for Rust.

An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::write performs non-atomic write operations on an underlying pointer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE concerns the Rust cgc crate, where Ptr::write can write to its underlying pointer without atomic protection. That matters when software assumes concurrent memory updates are safe. The public bundle gives no CVSS score, affected version list, exploit report, or named fixed release, so urgency depends on whether this crate is present and used in shared-memory code.

Executive priority

Set priority after confirming dependency use. If cgc is absent, risk is negligible. If present in production Rust code with concurrent memory access, prioritize review because memory safety defects can undermine reliability and data integrity.

Technical view

CVE-2020-36468 describes Ptr::write in the cgc crate through 2020-12-10 performing non-atomic writes on an underlying pointer. The likely risk is race-prone memory mutation when used in concurrent contexts. The supplied sources do not provide CWE, CVSS, exploit details, patch version, or concrete affected product inventory.

Likely exposure

Exposure is most likely limited to Rust applications or libraries that depend on the cgc crate and use Ptr::write. The source bundle lists affected vendor and product as n/a, so dependency inspection is required before assuming impact.

Exploitation context

The bundle does not indicate active exploitation, and KEV is false. No exploit proof, public weaponization, or attack prerequisites are provided. Treat this as a dependency safety issue requiring confirmation, not as confirmed internet-facing exploitation.

Researcher notes

Evidence is sparse. The core fact is non-atomic Ptr::write behavior in cgc through 2020-12-10. No CVSS, CWE, patched version, exploit status, or affected CPEs are supplied, so analysis should stay dependency-focused and avoid broad product claims.

Mitigation direction

  • Inventory Rust projects for the cgc crate in manifests and lockfiles.
  • Check RustSec and CVE records for current maintainer guidance.
  • Remove or replace cgc if no maintained fixed path is available.
  • Avoid shared concurrent use of Ptr::write until safety is confirmed.
  • Prioritize applications handling sensitive data or safety-critical workflows.

Validation and detection

  • Review Cargo.toml and Cargo.lock for cgc dependency presence.
  • Search code review artifacts for Ptr::write usage.
  • Assess whether affected code can run across threads or shared state.
  • Confirm whether any updated advisory names a fixed version.
  • Document affected services and owners before remediation planning.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-36468 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.