CVE-2020-35919: 
Rust vulnerability analysis and mitigation

An issue was discovered in the net2 crate before version 0.2.36 for Rust, where the crate made invalid assumptions about the memory layout of std::net::SocketAddr. The vulnerability was discovered and disclosed in December 2020 (RustSec Advisory).

The vulnerability stems from the net2 crate's assumption that std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. The crate simply casts pointers to convert socket addresses to the system representation. However, the standard library makes no guarantees about memory layout, which could lead to invalid memory access if the standard library implementation changes (RustSec Advisory). The vulnerability has a CVSS score of 5.5 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

If exploited, this vulnerability could result in invalid memory access when the standard library changes its implementation. The impact primarily affects availability (High), while there are no direct impacts on confidentiality or integrity. No warnings or errors would be emitted when such changes occur, making the issue particularly concerning (RustSec Advisory).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is needed to exploit this vulnerability. The scope is unchanged, meaning the impact is limited to the vulnerable component's security scope (RustSec Advisory).

The vulnerability has been patched in version 0.2.36 of the net2 crate. Users are advised to upgrade to this version or later to address the issue (RustSec Advisory).