RUSTSEC-2020-0017: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2020-0017/CVE-2020-35874) was discovered in the internment crate for Rust through version 2020-05-28. The issue was first identified on April 24, 2020, and involves a race condition in the ArcIntern::drop function that can lead to a use-after-free vulnerability (NVD).

The vulnerability stems from a race condition in the ArcIntern::drop function. The issue occurs when a concurrent thread creates a new ArcIntern with the same value as the one being destroyed after dropping the reference count but before taking the mutex, potentially resulting in a dangling pointer. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, GitHub Issue).

The race condition can lead to use-after-free scenarios, which could potentially result in memory corruption and security implications in applications using the affected internment crate versions (NVD).

The vulnerability requires high attack complexity but can be exploited without requiring privileges or user interaction. The attack vector is network-accessible, making it potentially exploitable remotely (NVD).

Users should update to a patched version of the internment crate. The vulnerability affects versions through 2020-05-28 (NVD).