RUSTSEC-2020-0052: 
Rust vulnerability analysis and mitigation

The crossbeam-channel crate before version 0.4.4 for Rust contained a vulnerability identified as RUSTSEC-2020-0052 (CVE-2020-35904). The issue was discovered in June 2020 and involved incorrect expectations about the relationship between memory allocation and iterator elements count. This vulnerability affected the ArrayQueue implementation in the crossbeam-channel crate (Github PR).

The vulnerability stemmed from the bounded channel incorrectly assuming that Vec::from_iter allocated capacity exactly matching the number of iterator elements. However, Vec::from_iter does not guarantee this and may allocate extra memory. The destructor of the bounded channel reconstructed Vec from the raw pointer based on these incorrect assumptions, leading to unsound behavior and causing deallocation with incorrect capacity when Vec::from_iter allocated different sizes than the number of iterator elements (Github PR). The issue received a CVSS v3.1 Base Score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to undefined behavior when deallocating memory, potentially causing memory corruption of allocator structures. In one reported case, it resulted in corruption of jemalloc structures and ultimately caused deadlocks (Github PR).

The vulnerability required local access and could be triggered through normal usage of the affected ArrayQueue implementation. The issue was particularly concerning as it affected a core synchronization primitive used in many Rust applications (NVD).

The vulnerability was fixed in crossbeam-channel version 0.4.4 by using Box<[T]> instead of Vec<T> for initialization and dropping of ArrayQueue, which guarantees exact capacity allocation. Users were recommended to upgrade to version 0.4.4 or later. The previous vulnerable version 0.4.3 was yanked from crates.io (Github PR).

The vulnerability garnered significant attention in the Rust community, with several major projects like Mozilla's Gecko engine and Servo browser engine updating their dependencies to address the issue. The discovery led to discussions about improving the release process for critical security fixes, as there was a two-month gap between the bug's discovery and the release of the fix (Github PR).