RUSTSEC-2020-0079: 
Rust vulnerability analysis and mitigation

An issue was discovered in the socket2 crate before version 0.3.16 for Rust programming language, identified as RUSTSEC-2020-0079 (CVE-2020-35920). The vulnerability was reported on December 31, 2020, and involves incorrect assumptions about memory representation in the std::net::SocketAddr implementation (RustSec Advisory).

The vulnerability stems from the socket2 crate making false assumptions about the std::net::SocketAddr memory representation. The issue specifically involves unsafe casting of std::net::SocketAddrV4 and SocketAddrV6 into libc::sockaddr without proper guarantees from the standard library about the layout of these structures. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD Database).

The vulnerability could potentially lead to undefined behavior (UB) if the memory representation of the affected structures changes. This particularly affects systems where the socket2 crate is used for network socket operations (GitHub Issue).

The vulnerability requires local access and low complexity to exploit, as indicated by the CVSS metrics. No known exploits in the wild have been reported at the time of assessment (NVD Database).

The vulnerability has been fixed in socket2 crate version 0.3.16 and later. Users are advised to upgrade to the latest version to mitigate this security issue (RustSec Advisory).