CVE-2020-25792: 
Rust vulnerability analysis and mitigation

An issue was discovered in the sized-chunks crate through version 0.6.2 for Rust. The vulnerability affects the Chunk implementation, where the array size is not checked when constructed with pair() function. This vulnerability was disclosed on September 6, 2020, and was assigned CVE-2020-25792 (NVD, RustSec).

The vulnerability has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue stems from improper validation of array indices (CWE-129) in the Chunk implementation. When using the pair() constructor, the code fails to verify if the array size matches the allocated capacity, which can lead to buffer overflow conditions (NVD).

The vulnerability can result in memory safety issues and potential buffer overflow conditions. When exploited, it could lead to program crashes or potential arbitrary code execution in the context of the application using the sized-chunks crate (RustSec).

The vulnerability can be triggered through normal API usage when constructing Chunk instances using the pair() method. A proof of concept demonstrating the issue was provided in the original bug report, showing how the array size check can be bypassed (GitHub Issue).

The issue was fixed in version 0.6.3 of the sized-chunks crate. Users should upgrade to this version or later to address the vulnerability. The fix includes proper array size validation and alignment checks (GitHub Commit).