CVE-2021-25904: 
Rust vulnerability analysis and mitigation

An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced in the Frame::copy_from_raw_parts() function, leading to a read of an arbitrary memory address, sometimes causing a segfault. The vulnerability was discovered on January 7, 2021 and disclosed on January 19, 2021 (RustSec Advisory).

The vulnerability exists in the Frame::copy_from_raw_parts() function, which is a safe API that can take and dereference a raw pointer. The function allows reading arbitrary memory addresses through improperly fed pointers without requiring unsafe blocks. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

This vulnerability allows attackers to read arbitrary memory addresses, which could lead to information exposure. Additionally, if an invalid memory address pointer is provided to the API, it may cause the program to crash through a segmentation fault, resulting in a denial of service condition (RustSec Advisory).

The vulnerability is highly exploitable as it requires no special privileges or user interaction. It can be triggered by providing malicious input to the affected API function, making it accessible through network vectors (RustSec Advisory).

The vulnerability was fixed in version 0.3.0 of the av-data crate by removing the unsafe Frame::copy_from_raw_parts() API function. Users should upgrade to version 0.3.0 or later to address this security issue (RustSec Advisory).