CVE-2020-35859: 
Rust vulnerability analysis and mitigation

An issue was discovered in the lucet-runtime-internals crate before version 0.5.1 for Rust, reported on January 24, 2020, and issued on October 1, 2020. The vulnerability affects the sigstack allocation functionality and has been assigned CVE-2020-35859 (RUSTSEC Advisory).

The vulnerability occurs in configurations using non-default WebAssembly globals sizes of more than 4KiB, or when compiled in debug mode without optimizations. The issue stems from incorrect sigstack allocation logic that can lead to memory corruption or data leaks. The vulnerability has been assigned a CVSS score of 9.1 (Critical) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (RUSTSEC Advisory).

The vulnerability can potentially cause data from the embedding host to leak to guest programs or cause corruption of guest program memory. This could lead to unauthorized access to sensitive information and potential system instability (RUSTSEC Advisory).

The vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction. The attack vector is network-based, making it accessible to remote attackers (RUSTSEC Advisory).

The vulnerability has been patched in versions 0.5.1 and later, as well as in version 0.4.3. Users are advised to upgrade to these patched versions. The fix involves correcting the sigstack allocation logic (RUSTSEC Advisory).