RUSTSEC-2021-0053: 
Rust vulnerability analysis and mitigation

The RUSTSEC-2021-0053 vulnerability affects the algorithmica crate through version 2021-03-07. The issue involves a double-free vulnerability in the merge_sort::merge() function implementation. This vulnerability was discovered by the Rust group at Georgia Tech (sslab-gatech) while scanning Rust code on crates.io (GitHub Issue).

The vulnerability stems from the implementation of merge_sort::merge() which incorrectly duplicates ownership of items from the list and invokes drop of the duplicated items via list[k] assignments. Additionally, a panic within the compare() function can trigger a double-free of items whose ownership was duplicated via .read(). The issue specifically affects types that implement the Drop trait (GitHub Issue).

When exploited, this vulnerability leads to undefined behavior in safe Rust code, specifically causing a double-free memory corruption. This can result in program crashes and potential security implications when dealing with memory management (GitHub Issue).

The vulnerability can be triggered simply by calling merge_sort::sort() on an array of type T where T implements the Drop trait. A proof-of-concept demonstrates this using a vector of String types, which results in a double-free detection and program termination with SIGABRT (GitHub Issue).