CVE-2020-35867: 
Rust vulnerability analysis and mitigation

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module. This vulnerability is tracked as CVE-2020-35867 and was discovered in December 2020 (NVD, RustSec).

The vulnerability received a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue specifically relates to memory safety violations that could occur through the create_module functionality. This was part of a broader security audit that uncovered several memory safety issues in the codebase (Release Notes).

The vulnerability could lead to memory safety violations, which in the context of the critical CVSS score indicates potential for complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability has a low attack complexity and requires no privileges or user interaction to exploit, as indicated by the CVSS metrics. The create_module functionality could be leveraged to violate memory safety constraints (NVD).

The vulnerability was fixed in rusqlite version 0.23.0. The fix involved making VTab/VTabCursor unsafe traits as implementing them on the wrong type was unsound, and ensuring create_module takes a &'static Module as that's what the reference was treated as (Release Notes).