RUSTSEC-2021-0010: 
Rust vulnerability analysis and mitigation

The vulnerability RUSTSEC-2021-0010 (CVE-2021-25907) was discovered in the containers crate versions before 0.9.11 for Rust. The issue was identified on January 12, 2021, by the Rust group at Georgia Tech (sslab-gatech). The vulnerability involves a potential double-free memory safety issue in the util::{mutate,mutate2} functions (GitHub Issue, NVD).

The vulnerability occurs in the containers.rs/src/util/mod.rs file where the functions mutate and mutate2 temporarily duplicate the ownership of an item. When a panic occurs during the execution of these functions, the duplicated item can be dropped twice, leading to a double-free condition. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to memory corruption through double-free conditions, which could potentially result in program crashes or security implications. When exploited, it could affect the integrity and reliability of applications using the affected versions of the containers crate (NVD).

A proof of concept exploit has been demonstrated using the BTree implementation in the containers crate. The exploit triggers a double free error by causing a panic during the execution of the insert_with function, which internally uses the vulnerable mutate function (GitHub Issue).

Users should upgrade to containers crate version 0.9.11 or later, which contains the fix for this vulnerability (NVD).