RUSTSEC-2021-0046: 
Rust vulnerability analysis and mitigation

An issue was discovered in the telemetry crate through 2021-02-17 for Rust, identified as RUSTSEC-2021-0046 (CVE-2021-29937). The vulnerability involves a potential drop of uninitialized memory that can occur if a value.clone() call panics within the misc::vec_with_size() function (NVD, CVE).

The vulnerability exists in the misc::vec_with_size() function where user-provided T::clone() can potentially panic. If T::clone() panics while the vector is partially uninitialized, it leads to uninitialized memory being dropped, resulting in undefined behavior. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is classified as CWE-908 (Use of Uninitialized Resource) (GitHub Issue, NVD).

The vulnerability can lead to undefined behavior due to the dropping of uninitialized memory, potentially resulting in high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability has been assigned high exploitability metrics with network vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N) (NVD).

The vulnerability was initially discovered and reported by the Rust group at Georgia Tech (sslab-gatech) while scanning Rust code on crates.io for potential vulnerabilities (GitHub Issue).