CVE-2021-28032: 
Rust vulnerability analysis and mitigation

An issue was discovered in the nano_arena crate before 0.5.2 for Rust, identified as CVE-2021-28032. The vulnerability was reported on January 31, 2021, and officially issued on March 2, 2021. The vulnerability affects the nano_arena crate's implementation of the split_at function, which contains an aliasing violation that could lead to serious security implications (RustSec Advisory).

The vulnerability stems from an incorrect assumption in the nano_arena crate's implementation where it assumed that Borrow was guaranteed to return the same value on .borrow(). The borrowed index value was used to retrieve a mutable reference to a value. If the Borrow implementation returned a different index, the split arena would allow retrieving the index as a mutable reference, creating two mutable references to the same element. This violates Rust's aliasing rules. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (RustSec Advisory).

The vulnerability can result in memory safety issues, potentially leading to out-of-bounds writes or use-after-free conditions. This could allow attackers to compromise system security and potentially execute arbitrary code (RustSec Advisory).

The vulnerability affects the split_at function in versions prior to 0.5.2 of the nano_arena crate. The issue can be triggered when the Borrow implementation behaves in certain ways, allowing for the creation of multiple mutable references to the same memory location (RustSec Advisory).

The vulnerability was fixed in version 0.5.2 of the nano_arena crate. The fix was implemented in commit 6b83f9d by storing the .borrow() value in a temporary variable. Users should upgrade to version 0.5.2 or later to mitigate this vulnerability (RustSec Advisory).