Microsoft's AI Bug Hunter Finds Rust Flaw That Went Undetected for Nearly 11 Years

Microsoft Uncovers Long-Standing Rust Bug 🚀

Microsoft researchers have uncovered a memory-safety bug in Rust’s standard library that had gone undetected for nearly 11 years. This discovery includes other flaws that can trigger undefined behavior even in applications written entirely in safe Rust.

Key Findings 🔍

• Two of the findings affect stable Rust, including a separate issue that could cause applications to access freed memory.
• The nearly 11-year-old bug involves Rust’s process::exit function. Calling this function from a child thread could cause the runtime to remove the main thread’s alternate signal stack while it is still running. If the main thread experiences a stack overflow, the operating system may be unable to deliver the signal correctly, resulting in a segmentation fault instead of Rust’s intended stack-overflow handling.

Research Methodology 🛠️

The research utilized Hyenas, FORGE Lab’s AI-powered vulnerability-scanning system, to investigate unsafe code in Rust’s standard library. Microsoft reported that some bugs were identified with the help of Hyenas. Researchers examined the underlying code, reproduced the issues, assessed their security impact, and reported them to Rust maintainers. Microsoft stated that the practical risk is limited, as each flaw requires unusual conditions to trigger.

Rust’s Safety Model 🛡️

Rust’s ownership model and type system are designed to prevent memory-safety problems commonly associated with languages like C and C++. However, its standard library relies on unsafe code internally for operations that the compiler cannot verify. Microsoft categorized the findings into three groups:

• Unsafe code that assumes operations will not panic.
• Code that trusts user-provided implementations to behave correctly.
• Code that makes incorrect assumptions about the underlying system.

Additional Issues Identified ⚠️

• A panic-safety problem was found in Rust’s MapWindows::clone implementation, where an operation could trigger a panic and cause the buffer’s destructor to access uninitialized memory.
• Another finding involved str::replace, where the function could make an incorrect assumption about a custom implementation of the nightly Pattern trait, potentially causing invalid UTF-8 data.
• Additionally, a problem in Rust’s CommandExt::exec functionality was identified, which could modify the process-wide environment variable array while holding a read lock, leading to inconsistent data access.

Microsoft has proposed fixes for these issues, which are currently under review.

For more details, check out the full article: Read full article