CVE-2020-36210: 
Rust vulnerability analysis and mitigation

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption (NVD, RustSec).

The vulnerability stems from a panic safety issue in the implementation of Random trait for arrays. When a panic occurs in a user-provided T::random() function, it can lead to dropping partially uninitialized array of type T. The dropping of uninitialized T can potentially cause memory corruption or undefined behavior. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (RustSec).

The vulnerability can result in memory corruption and undefined behavior when uninitialized memory is dropped during a panic condition. This could potentially lead to security implications including high impact on confidentiality, integrity, and availability of the affected system (RustSec).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is needed to exploit this vulnerability. The scope is unchanged, meaning the impact is limited to the scope of the affected component (RustSec).

The vulnerability was fixed in version 0.2.3 of the autorand crate. The fix was implemented in commit 565d508 by using MaybeUninit to avoid possible dropping of uninitialized memory upon panic. Users should upgrade to version 0.2.3 or later to address this vulnerability (RustSec).