RUSTSEC-2021-0012: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2021-0012) was discovered in the cdr-rs Rust crate, specifically in the Deserializer::read_vec method. The issue was identified and reported on January 2, 2021, by the Rust research group at Georgia Tech (sslab-gatech). The vulnerability affects the memory safety and soundness of applications using this crate (GitHub Issue).

The vulnerability exists in the Deserializer::read_vec method within the cdr-rs/src/de.rs file. The method creates an uninitialized buffer and passes it to a user-provided Read implementation through the read_exact function. This implementation is unsound as it allows safe Rust code to trigger undefined behavior by reading from uninitialized memory (GitHub Issue).

The vulnerability could lead to undefined behavior in Rust applications using the cdr-rs crate, potentially compromising memory safety guarantees that Rust typically provides (GitHub Issue).

The vulnerability can be triggered when using the Deserializer::read_vec method with a user-provided Read implementation, potentially exposing applications to memory-related security issues (GitHub Issue).

The recommended fix is to zero-initialize the newly allocated part of the u8 buffer before the read operation. This prevents user-provided Read implementations from accessing old contents from the newly allocated heap memory (GitHub Issue).