CVE-2020-35711: 
Rust vulnerability analysis and mitigation

A vulnerability was discovered in the arc-swap crate before version 0.4.8 (and 1.x before 1.1.0) for Rust, identified as CVE-2020-35711. The issue involves the use of arc_swap::access::Map with the Constant test helper or user-supplied implementation of the Access trait, which could lead to dangling references being returned by the map. The vulnerability was reported on December 10, 2020, and officially issued on December 11, 2020 (RustSec Advisory).

The vulnerability exists in the implementation of the Access trait for Map where the unsafe code in MapGuard expects the underlying guard type to dereference to the same value even when the guard object is moved. However, Map uses Access as a trait bound which does not guarantee this property. This results in Map accessing a dangling pointer when used with an Access implementation that does not dereference to the same value when moved. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

When exploited, this vulnerability can lead to undefined behavior in safe Rust code, potentially causing segmentation faults and program crashes. The issue primarily affects availability with no direct impact on confidentiality or integrity of the system (RustSec Advisory).

The vulnerability can be triggered using only safe APIs of arc-swap. A proof-of-concept exists demonstrating how the issue can be exploited to cause a program crash through a segmentation fault when using the Constant test helper (GitHub Issue).

The vulnerability has been patched in versions 0.4.8 and 1.1.0 of the arc-swap crate. The fix involves replacing the implementation without unsafe code, though this comes at the cost of adding a Clone bound on the closure and a small performance penalty (RustSec Advisory).