CVE-2021-29929: 
Rust vulnerability analysis and mitigation

An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. The vulnerability (CVE-2021-29929) involves a double drop condition that can occur when a user-provided Endian implementation panics. The issue was reported on January 4, 2021, and was officially issued on March 7, 2021 (RustSec Advisory).

The vulnerability stems from the crate's failure to guard against panics from user-provided implementations of the Endian trait, which is a safe trait that users can implement. When a user-provided implementation of the Endian trait panics, it triggers a double-drop due to duplicated ownership of T created by ptr::read(). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (RustSec Advisory).

The double-drop (or double free) condition can result in memory corruption in the heap. This vulnerability primarily affects the availability of the system, with no direct impact on confidentiality or integrity (RustSec Advisory).

As of the last available information, there are no patched versions of the endian_trait crate that address this vulnerability (RustSec Advisory).