RUSTSEC-2021-0014: 
Rust vulnerability analysis and mitigation

A memory-safety/soundness issue was discovered in the marc crate versions prior to 2.0.0 for Rust, identified as RUSTSEC-2021-0014. The vulnerability was reported on January 27, 2021, by the Rust group at Georgia Tech (sslab-gatech). The issue affects the Record::read method in the marc crate, which is a Rust library for handling MARC (Machine-Readable Cataloging) records (NVD, GitHub Issue).

The vulnerability exists in the Record::read method where an uninitialized buffer is passed to a user-provided Read implementation. According to the Read trait documentation, it is unsafe to call read with an uninitialized buffer as it can lead to undefined behavior. The issue is located in the rust-marc/src/lib.rs file, where the code creates an uninitialized buffer and attempts to read into it. The vulnerability received a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows a user-provided Read implementation to gain access to the old contents of newly allocated memory, violating memory safety guarantees. This could potentially lead to information disclosure by exposing uninitialized memory contents (NVD).

The vulnerability is exploitable through a custom Read implementation that can access uninitialized memory. The issue requires no special privileges or user interaction to exploit, as indicated by the CVSS metrics (NVD).

A naive but safe approach to fix the issue is to zero-initialize the buffer before lending it to a user-provided Read implementation, though this adds runtime performance overhead. As of January 2021, there was no ideal fix available in stable Rust that would work without performance impact. Users should upgrade to version 2.0.0 or later of the marc crate (GitHub Issue).