RUSTSEC-2021-0085: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2021-0085/CVE-2021-45683) was discovered in the binjs_io crate through version 2021-01-03 for Rust. The issue was identified by the Rust research group at Georgia Tech (sslab-gatech) and disclosed on January 3, 2021. The vulnerability affects the Read method implementation in the binjs_io crate, which could potentially lead to reading from uninitialized memory locations (NIST NVD, GitHub Issue).

The vulnerability stems from four instances where uninitialized buffers are created and passed to user-provided Read implementations. This violates the Read trait documentation's safety requirements, which explicitly states that buffers must be initialized before calling read. The issue was found in multiple source files including compress.rs, util.rs, and read.rs. The CVSS v3.1 base score is 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-908 (Use of Uninitialized Resource) (NIST NVD).

The vulnerability allows safe Rust code to exhibit undefined behavior through reading from uninitialized memory. This could potentially lead to memory safety violations and security implications, particularly given the critical CVSS score of 9.8 (NIST NVD).

The vulnerability can be triggered when using the Read method implementation in affected versions of the binjs_io crate. The low attack complexity (AC:L) and no requirements for privileges (PR:N) or user interaction (UI:N) make this vulnerability particularly concerning (NIST NVD).

The suggested fix involves zero-initializing the newly allocated u8 buffer before read(), which prevents user-provided Read from accessing old contents of the newly allocated heap memory. This ensures that no uninitialized memory can be accessed during the read operation (GitHub Issue).