CVE-2020-35904: 
Rust vulnerability analysis and mitigation

An issue was discovered in the crossbeam-channel crate before version 0.4.4 for Rust. The vulnerability, identified as CVE-2020-35904, involves incorrect assumptions about the relationship between memory allocation and iterator elements count. The issue was reported on June 26, 2020, and officially issued on October 11, 2020 (RustSec Advisory).

The bounded channel implementation incorrectly assumes that Vec::from_iter allocates capacity equal to the number of iterator elements. However, Vec::from_iter provides no such guarantee and may allocate extra memory. When the bounded channel's destructor reconstructs Vec from the raw pointer based on these incorrect assumptions, it leads to unsound behavior and incorrect deallocation when Vec::from_iter has allocated different sizes than the number of iterator elements (RustSec Advisory). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability results in memory corruption due to incorrect deallocation, which can lead to undefined behavior in applications using the affected versions of the crossbeam-channel crate (RustSec Advisory).

The vulnerability requires local access and low complexity to exploit, with no user interaction required. It primarily affects the availability of the system through potential crashes due to memory corruption (NVD).

The vulnerability has been patched in version 0.4.4 and later of the crossbeam-channel crate. Users should upgrade to version 0.4.4 or newer to resolve this issue. Versions prior to 0.4.3 are unaffected by this vulnerability (RustSec Advisory).