CVE-2020-35906: 
Rust vulnerability analysis and mitigation

An issue was discovered in the futures-task crate before 0.3.6 for Rust. The vulnerability, identified as CVE-2020-35906, involves futures_task::waker potentially causing a use-after-free in a non-static type situation. The issue was reported on September 4, 2020, and the advisory was issued on October 31, 2020 (RustSec Advisory).

The vulnerability stems from improper implementation of a 'static lifetime bound on the waker function. This implementation flaw could result in a use-after-free condition if Waker::wake() is called after the original data had been dropped. The vulnerability has been assigned a CVSS score of 7.8 (HIGH), indicating significant severity (RustSec Advisory).

The vulnerability can lead to use-after-free conditions, potentially resulting in arbitrary code execution, memory corruption, and memory management issues. The CVSS scoring indicates high impacts on confidentiality, integrity, and availability of affected systems (RustSec Advisory).

The vulnerability has a local attack vector with low attack complexity and requires low privileges with no user interaction. The scope is unchanged, meaning the impact is limited to the scope of the affected component (RustSec Advisory).

The vulnerability was patched in version 0.3.6 of the futures-task crate by adding a 'static lifetime bound to the data waker takes. Versions 0.2.1 and earlier are unaffected by this vulnerability. Users are advised to upgrade to version 0.3.6 or later (RustSec Advisory).