CVE-2020-36464

Vulnerability

The heapless crate (versions prior to 0.6.1) contains an unsoundness in the IntoIter::Clone implementation. The Clone trait for IntoIter clones the entire underlying Vec without accounting for whether the iterator has been partially consumed via next() calls. This results in a use-after-free and double-free scenario where already-dropped elements are cloned and then later dropped again [1][2][3].

Exploitation

An attacker does not require any special network position or authentication; the vulnerability is triggered entirely by normal usage of the crate's API. The affected code path is executed when a user calls .clone() on a IntoIter that has been partially advanced (e.g., after calling next() and dropping the returned item). No race conditions or user interaction beyond programmatic calls are needed. A minimal proof-of-concept involves creating a Vec, converting it to IntoIter, calling next() on the iterator, and then calling clone() on the iterator [3].

Impact

Successful exploitation leads to memory corruption: cloning already-dropped elements results in a use-after-free (reading freed memory) and a double-free (dropping elements again). This can cause undefined behavior, including arbitrary code execution or denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores availability impact as High, though the unsoundness can also undermine memory safety in other ways [1][2].

Mitigation

The vulnerability is fixed in heapless version 0.6.1 and later. Users should update to >=0.6.1 immediately. The fix ensures that IntoIter::Clone only clones the remaining unconsumed elements of the iterator. No workaround is available for earlier versions; patching the dependency is the only mitigation [2][3].