Microsoft researchers utilizing an AI bug hunter have uncovered a memory-safety bug in Rust’s standard library that went undetected for nearly 11 years, alongside other...
Microsoft researchers using an AI bug hunter have uncovered a memory-safety flaw in Rust’s standard library remaining undetected for nearly 11 years, affecting stable Rust applications.
What broke and the current status
Microsoft researchers utilizing an AI bug hunter have uncovered a memory-safety bug in Rust’s standard library that went undetected for nearly 11 years, alongside other flaws that can trigger undefined behavior even in applications written entirely in safe Rust. Two of the findings affect stable Rust, including a separate issue that could cause applications to access freed memory.
The nearly 11-year-old bug involves Rust’s process::exit function. Microsoft’s FORGE Lab researchers found that calling this function from a child thread could cause the runtime to remove the main thread’s alternate signal stack while it was still running. If the main thread subsequently experienced a stack overflow, the operating system could be unable to deliver the signal correctly, resulting in a segmentation fault instead of Rust’s intended stack-overflow handling.
Additionally, Microsoft fixed an RCE bug in Windows Paint after weeks of confusion following a disclosure last month where messaging regarding a patch was unclear.
How to check if you are affected
The brief does not provide a specific method or command for readers to check whether their systems or codebases are actively impacted by these specific memory-safety flaws. Verification relies on authoritative specifications and documentation.
What to do now
Specific mitigation steps for the Rust standard library vulnerabilities are not detailed in the brief. Regarding the separate Windows Paint RCE bug disclosed last month, Microsoft has released a fix following weeks of unclear messaging on a patch.
Frequently Asked Questions
Q1: What component does the nearly 11-year-old bug involve?
The long-standing bug involves Rust’s process::exit function.
Q2: Which versions of Rust are impacted by the findings?
Two of the findings affect stable Rust, including the issue that can cause applications to access freed memory.
Q3: What happens if the main thread experiences a stack overflow after calling `process::exit` from a child thread?
The operating system could fail to deliver the signal correctly, resulting in a segmentation fault instead of Rust’s intended stack-overflow handling.