RUSTSEC-2021-0047: 
Rust vulnerability analysis and mitigation

A double-free vulnerability (RUSTSEC-2021-0047) was discovered in the slice-deque crate through 2021-02-19 for Rust. The vulnerability was identified in the SliceDeque::drain_filter function, where a double drop can occur upon a panic in a predicate function. The issue was assigned CVE-2021-29938 and affects all versions of the slice-deque crate up to and including the 2021-02-19 release (NVD).

The vulnerability stems from a panic safety issue in the DrainFilter implementation returned by the SliceDeque::drain_filter function. The core issue lies in the code incrementing self.idx before calling self.pred, which can potentially panic. This sequence can leave the SliceDeque in an inconsistent state, leading to a double-free condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can result in memory corruption through a double-free condition. The issue occurs when the predicate function panics during execution, causing the same memory location to be freed twice. This can potentially lead to program crashes and undefined behavior (GitHub Issue).

The vulnerability can be triggered by causing a panic in the predicate function passed to drain_filter. A proof-of-concept demonstration shows that when the predicate panics during iteration, it leads to a double-drop of elements in the SliceDeque (GitHub Issue).

Users should upgrade to a version of slice-deque released after February 19, 2021, which contains the fix for this vulnerability (NVD).