Microsoft says its FORGE Lab found several memory safety issues in Rust’s standard library, including cases where code written entirely in safe Rust can trigger undefined behavior. The researchers reported the bugs to Rust maintainers, who worked with them on fixes. Two issues reported by the team remained open at publication.
Rust uses unsafe code beneath many standard library APIs. That code must preserve memory safety regardless of how callers use the safe API. Microsoft groups its findings around three assumptions that can break that promise: that code will not panic, that caller-provided implementations will behave correctly, and that the operating system will preserve expected state.
Safe code can expose unsafe library code
One issue affects the nightly Iterator::map_windows API. Microsoft says a caller’s clone method can panic while a window buffer is only partly initialized. Its proof of concept uses safe code and crashes when the buffer’s destructor accesses uninitialized memory. The described fix keeps the buffer from being dropped until it is fully initialized.
Another issue affects str::replace when used with a custom implementation of the nightly Pattern trait. Microsoft says a pattern can supply a byte that leads the function to return a String containing invalid UTF-8. Later string operations can then reach undefined behavior. The described fix changes the type used by the fast path so it guarantees valid UTF-8.
System state creates another failure
Microsoft also found that calling process::exit from a child thread can unmap the main thread’s alternate signal stack before the main thread stops running. If that thread overflows its stack during the interval, Microsoft’s proof of concept ends in a segmentation fault instead of Rust’s stack overflow message. The described fix leaves the main thread’s alternate stack in place.
Some findings were aided by Hyenas, FORGE’s research version of the AI-powered vulnerability scanner codenamed MDASH. Microsoft says its researchers checked the code, reproduced the bugs and assessed their potential security impact. The findings concern the standard library’s unsafe code, not compiler bugs.
A related change is due in Rust 1.100 on November 12. According to Microsoft, the stabilized Allocator API will require custom allocator implementations not to unwind from their methods or from drop, after reports showed that unwinding could make standard library code unsound.
