CVE-2021-25906: 
Rust vulnerability analysis and mitigation

An issue was discovered in the basic_dsp_matrix crate before version 0.9.2 for Rust, identified as CVE-2021-25906. The vulnerability was reported on January 10, 2021, and officially issued on January 20, 2021. The vulnerability relates to a panic safety issue in the implementation of TransformContent for specific array types (SOURCE).

The vulnerability occurs when a TransformContent panic occurs, resulting in a double drop being performed. The issue specifically involves unguarded double drop operations while temporarily duplicating objects' ownership using ptr::read(). When a panic occurs in a user-provided function conversion, objects copied by ptr::read() are dropped twice, leading to memory corruption. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (SOURCE, NVD).

The vulnerability can lead to memory corruption when exploited, potentially affecting system stability and availability. The CVSS scoring indicates high impact on availability while maintaining no direct impact on confidentiality or integrity (SOURCE).

The vulnerability has network-based attack vector (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N) to exploit (SOURCE).

The vulnerability has been patched in version 0.9.2 of the basic_dsp_matrix crate. The fix involves using ManuallyDrop to enclose objects that are to be temporarily duplicated, preventing the double drop issue (SOURCE).