CVE-2021-29937: 
Rust vulnerability analysis and mitigation

An issue was discovered in the telemetry crate through 2021-02-17 for Rust. The vulnerability (CVE-2021-29937) involves a memory corruption issue where uninitialized memory can be dropped if a value.clone() call panics within the misc::vecwithsize() function (RustSec Advisory).

The vulnerability occurs in the misc::vecwithsize function which creates a vector of a provided size and calls vec.set_len(size) on it, initially filling it with uninitialized memory. It then inserts elements using vec[i] = value.clone(). If the value.clone() call panics during this process, uninitialized items in the vector will be dropped, leading to undefined behavior (RustSec Advisory). The vulnerability has been assigned a CVSS score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (RustSec Advisory).

The vulnerability can lead to memory corruption and undefined behavior when uninitialized memory is dropped. This has potential implications for memory safety and could result in high impacts to confidentiality, integrity, and availability of affected systems (RustSec Advisory).