CVE-2021-26954: 
Rust vulnerability analysis and mitigation

An issue was discovered in the qwutils crate before version 0.3.1 for Rust. The vulnerability, identified as CVE-2021-26954, was reported on February 3, 2021, and officially issued on February 4, 2021. The vulnerability affects the insert_slice_clone function in the qwutils crate, which is a Rust software component (RustSec Advisory).

The vulnerability occurs when using ptr::copy for inserting elements into the middle of a Vec. During this operation, when ownership is temporarily duplicated, the clone method of a user-provided element is called. If the Clone operation panics during execution, it can result in a double-free condition, where the same memory location is freed twice. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating network accessibility with low attack complexity and no required privileges or user interaction (NVD).

The vulnerability can lead to memory corruption through a double-free condition when a Clone panic occurs during the insert_slice_clone operation. This could potentially affect the availability of the system running the vulnerable code (RustSec Advisory).

The issue has been fixed in qwutils version 0.3.1 and later. The fix involves adding a set_len(0) call before operating on the vector to prevent element dropping during a panic. Users should upgrade to version 0.3.1 or later to mitigate this vulnerability (RustSec Advisory).