CVE-2020-25794: 
Rust vulnerability analysis and mitigation

The sized-chunks crate through version 0.6.2 for Rust contains multiple soundness issues affecting the Chunk and InlineArray implementations. The vulnerability was discovered in September 2020 and assigned CVE-2020-25794. The vulnerability specifically affects the Chunk implementation, where clone operations can have memory-safety issues upon a panic (RustSec Advisory, GitHub Issue).

The vulnerability manifests in several ways: 1) Array size is not checked when constructed with unit() and pair() functions, 2) Array size is not checked when constructed with From>, 3) Clone and insert_from operations are not panic-safe, where a panicking iterator can cause memory safety issues, and 4) InlineArray generates unaligned references for types with large alignment requirements. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

When exploited, the vulnerability can lead to memory safety violations, including potential double-free of memory, dropping of uninitialized memory during unwinding, and memory corruption. This can result in program crashes and potential denial of service conditions (GitHub Issue).

The vulnerability can be triggered through normal usage of the affected functions when handling panics in iterators or when dealing with specific memory alignment requirements. A proof of concept demonstrating the issues has been published, showing how the vulnerability can be triggered through various code paths (GitHub Issue).

The vulnerability has been patched in version 0.6.3 of the sized-chunks crate. Users are advised to upgrade to this version or later to address these security issues (RustSec Advisory).