CVE-2021-28035: 
Rust vulnerability analysis and mitigation

An issue was discovered in the stack_dst crate before version 0.6.1 for Rust, identified as CVE-2021-28035. The vulnerability stems from the push_inner behavior, where a drop of uninitialized memory can occur upon a val.clone() panic (RUSTSEC Advisory, NVD).

The vulnerability is related to the push_inner function implementation in the stack_dst crate. When the function increases the internal length of the array and then calls val.clone(), a panic during the clone operation can lead to memory corruption. The issue has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness has been classified as CWE-908 (Use of Uninitialized Resource) (RUSTSEC Advisory, NVD).

The vulnerability can result in two severe consequences: the dropping of uninitialized memory or a double free condition when a panic occurs during the clone operation. This can lead to memory corruption and potential security implications in applications using the affected versions of the stack_dst crate (RUSTSEC Advisory).

The vulnerability affects the stack_dst::StackA::push_cloned function in versions prior to 0.6.1. The issue occurs specifically when the val.clone() operation panics during execution (RUSTSEC Advisory).

The vulnerability has been fixed in version 0.6.1 of the stack_dst crate. The fix involves modifying the push_inner function to increase the length of the array after elements are cloned, rather than before. Users should upgrade to version 0.6.1 or later to address this security issue (RUSTSEC Advisory).