CVE-2020-36464

Name of the Vulnerable Software and Affected Versions heapless crate versions prior to 0.6.1

Description The issue arises from the IntoIter Clone implementation, which clones the entire underlying Vec without considering whether it has already been partially consumed. This can lead to a use-after-free access if the iterator is partially consumed, as the consumed items will be copied. A proof of concept is available, demonstrating the potential for exploitation.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Clone implementation on partially consumed IntoIter instances to minimize the risk of exploitation.