CVE-2021-28877: 
Alibaba Cloud Linux (Aliyun Linux) vulnerability analysis and mitigation

CVE-2021-28877 affects the standard library in Rust versions before 1.51.0. The vulnerability is related to the Zip implementation incorrectly calling __iterator_get_unchecked() for the same index multiple times when nested (NVD, Rust PR).

The vulnerability stems from a composition error in the TrustedRandomAccess specialization for nested iter::Zips. When a Zip adapter is partially consumed and then wrapped into another Zip where the adapters use their TrustedRandomAccess specializations, it leads to the outer adapter returning elements that should have already been consumed. This occurs due to an unmet safety requirement for the TrustedRandomAccess trait. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a memory safety violation, potentially resulting in undefined behavior or program crashes. This could be exploited to cause denial of service conditions in applications using the affected Rust versions (Gentoo Advisory).

The issue requires specific conditions where nested Zip iterators are used with TrustedRandomAccess specializations. The bug had existed for years before being discovered, suggesting that while serious, it may be relatively difficult to trigger in practice (Rust PR).

The vulnerability was fixed in Rust version 1.51.0. Users should upgrade to this version or later to address the issue. For Gentoo users specifically, upgrading to rust-1.63.0-r1 or rust-bin-1.64.0 is recommended (Gentoo Advisory).