RUSTSEC-2020-0081: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2020-0081/CVE-2020-35922) was discovered in the mio crate versions before 0.7.6 for Rust, identified on November 2, 2020. The issue relates to incorrect assumptions about the memory representation of std::net::SocketAddr in the Rust standard library (NVD).

The vulnerability stems from unsafe assumptions in the mio crate's handling of socket address memory layouts. Specifically, in mio/src/sys/unix/net.rs, the code assumes that the memory layout of SocketAddrV4 and SocketAddrV6 matches exactly with libc::sockaddr, which is not guaranteed by Rust's standard library. This could lead to undefined behavior if the representation changes, such as when padding is added early in the struct, potentially resulting in C code reading uninitialized bytes (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability primarily affects the availability of systems using the affected versions of the mio crate. According to the CVSS metrics, while there is no impact on confidentiality or integrity, there is a high impact on availability when exploited (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is required for exploitation, as indicated by the CVSS vector (NVD).

The vulnerability was fixed in mio version 0.7.6. Users should upgrade to this version or later to mitigate the issue (NVD).