CVE-2020-25791: 
Rust vulnerability analysis and mitigation

An issue was discovered in the sized-chunks crate through version 0.6.2 for Rust, affecting both Chunk and InlineArray implementations. The vulnerability was reported on September 6, 2020, and officially issued on October 1, 2020. Multiple soundness issues were identified, including unchecked array sizes and memory safety concerns (RustSec Advisory, GitHub Issue).

The vulnerability encompasses multiple issues: 1) In the Chunk implementation, array size is not checked when constructed with unit() and pair() methods, 2) Array size verification is missing when constructed with From>, 3) Clone and insert_from operations are not panic-safe, where a panicking iterator can cause memory safety issues, 4) InlineArray generates unaligned references for types with large alignment requirements. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

The vulnerability can lead to memory safety violations, potential crashes, and uninitialized memory being dropped while unwinding. In cases of panicking iterators, it can result in double-free scenarios, and for types with large alignment requirements, it can generate unaligned references (GitHub Issue).

The vulnerability can be triggered through normal usage of the affected methods in the sized-chunks crate. Specifically, it can be exploited by constructing arrays using unit() or pair() methods, using From> implementations, or working with types that have large alignment requirements (GitHub Issue).

The vulnerability has been patched in version 0.6.3 and later releases of the sized-chunks crate. Users are advised to upgrade to the patched version to address these security issues (RustSec Advisory).