RUSTSEC-2020-0100: 
Rust vulnerability analysis and mitigation

A double free vulnerability was discovered in the sys-info crate versions prior to 0.8.0 for Rust. The vulnerability, tracked as RUSTSEC-2020-0100 and CVE-2020-36434, was identified in the sys_info::disk_info calls functionality. The issue was publicly disclosed and assigned a CVE identifier on August 8, 2021 (NVD).

The vulnerability stems from thread-safety issues in the disk_info() function implementation. When disk_info() is called from multiple threads simultaneously, it can lead to a race condition involving a global DFhashvector structure. The cleanup process at the end of the get_disk_info() function attempts to free memory simultaneously from different threads, resulting in a double free condition (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The double free vulnerability can lead to memory corruption and potential program crashes. Given the CVSS score and vector, the vulnerability can potentially be exploited remotely with no required privileges or user interaction, potentially leading to high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability can be triggered when multiple threads simultaneously call the disk_info() function. The low attack complexity (AC:L) in the CVSS score indicates that the vulnerability is relatively straightforward to exploit under the right conditions (NVD).

Users should upgrade to sys-info version 0.8.0 or later which contains the fix for this vulnerability (NVD).