RUSTSEC-2020-0040: 
Rust vulnerability analysis and mitigation

An issue was discovered in the obstack crate before version 0.1.4 for Rust programming language. The vulnerability is tracked as RUSTSEC-2020-0040 and CVE-2020-35894, which was disclosed on December 31, 2020. The vulnerability affects the obstack project's crate implementation, specifically versions prior to 0.1.4 (NVD, RustSec).

The vulnerability stems from incorrect padding calculation in the memory allocation process, which can result in unaligned references for types that require large alignment. The issue specifically occurs in the alloc function where the padding calculation is incorrect, using start_ptr as usize % alignment instead of the correct formula (alignment - (start_ptr % alignment)) % alignment. This implementation error leads to potential memory misalignment issues. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

The vulnerability can lead to unaligned memory references, particularly affecting types that require large alignment (such as types with #[repr(align(256))]). This misalignment can cause undefined behavior in Rust programs using the affected versions of the obstack crate, potentially leading to memory corruption or application crashes (GitHub Issue).

The vulnerability requires no special privileges or user interaction to exploit, as indicated by the CVSS metrics (PR:N/UI:N). The attack vector is network-accessible (AV:N), and the attack complexity is low (AC:L) (NVD).

Users should upgrade to obstack version 0.1.4 or later, which contains the fix for this vulnerability. The fix involves correcting the padding calculation formula in the allocation function (RustSec).