CVE-2020-35864: 
Rust vulnerability analysis and mitigation

An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. The vulnerability affects the read_scalar and read_scalar_at functions, which can transmute values without unsafe blocks (NVD, RustSec).

The vulnerability exists in the read_scalar and read_scalar_at functions which are unsound as they allow transmuting values without using unsafe blocks. This affects versions from 0.4.0 up to 1.12.0 of the flatbuffers crate. The issue has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec).

The vulnerability can lead to memory safety issues, including the potential creation of dangling references. This poses a significant risk to application stability and security, as demonstrated by proof-of-concept code that can create invalid references to static strings (RustSec).

The vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction. The attack vector is network-accessible, making it particularly concerning for networked applications using the affected flatbuffers versions (RustSec).

The vulnerability has been patched in version 2.0.0 and later of the flatbuffers crate. Users should upgrade to these patched versions. Versions prior to 0.4.0 are not affected by this vulnerability (RustSec).