CVE-2021-25908: 
Rust vulnerability analysis and mitigation

An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. The vulnerability (CVE-2021-25908) involves a double free condition that can occur in the From<EventList> implementation. The issue affects versions from 0.12.0 up to and including 0.19.4 (RustSec Advisory).

The vulnerability occurs when the crate reads from a container using ptr::read in From implementation, and then calls a user-specified Into function. If the user-provided function panics, it can result in a double free condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

The vulnerability can lead to a double free condition, which could result in memory corruption and potential program crashes. This primarily affects the availability of the system, as indicated by the CVSS metrics showing high impact on availability but no direct impact on confidentiality or integrity (RustSec Advisory).

The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N). The scope is unchanged (S:U), indicating the impact is limited to the vulnerable component (RustSec Advisory).

As of the advisory publication, there are no patched versions available. Users of versions 0.12.0 and later are affected. The only current mitigation is to use versions prior to 0.12.0, which are unaffected by this vulnerability (RustSec Advisory).