Comment by coliveira

11 days ago

A nasty and rare bug can and will be exploited once it is found. The only thing necessary is for malicious actors to start adding this case in innocent looking code and there you have.

9 comments

coliveira

Reply
afdbcreid  11 days ago

That's a misunderstanding. This is not a security vulnerability and Rust explicitly does not defend from malicious programs, only from mistakes. This bug however is quite dangerous, because unlike many soundness bugs it seems plausible to hit by mistake.

  • Liquid_Fire  11 days ago

    > it seems plausible to hit by mistake

    The report seems to claim the opposite:

    > Looking at the bug itself, it is also very likely that this unsoundness has not caused memory unsafety by accident. While it looks easy to trigger, to exploit this you need an intentionally malicious Drop implementation.

    • afdbcreid  11 days ago

      This edit is newer than my comment (and its writer is an experienced T-types member, so I take back my words).

    • j4k0bfr  10 days ago

      I'm happy to admit I don't really know what I'm talking about with this bug, however the ability to leak memory is pretty demonstrable, no? The OP's example of using a global cache with Drop seems a bit gross... but that hasn't ever stopped C devs lol (as a proud C dev myself).

      I guess my take is that I'd rather assume this is exploitable in the wild until sufficient time has passed. Would be cool to see clippy pick up on this bug in older versions!

      2 replies →

  • rstuart4133  10 days ago

    > This bug however is quite dangerous, because unlike many soundness bugs it seems plausible to hit by mistake.

    Possibly. I'm no rust expert, so I had the read the code slowly, building up a mental model of the types being used. For me, the effort that required is one of the more painful aspects of Rust.

    Nonetheless when I got to this line, I stopped reading:

        q.0 = Some(&l);

    Given the type declarations it's "obvious" it should not compile as it directly contradicts the types 'static lifetime. You don't deliberately write code that doesn't compile.

    I write lots of code that doesn't compile of course. It's perfectly safe because the compiler catches it. Right now, I feel like a climber at the top of a mountain who just discovered he forgot to attach his safety harness.

    Who knows. Maybe all of crates.io will compile with the fixed compiler, because this is a mistake humans or LLM's never make. We will see.