11 year old unsoundness bugs found in Rust borrow checker
A long-standing soundness bug has been discovered in the Rust programming language's borrow checker, allowing lifetime requirements to be bypassed. This vulnerability, categorized as a high-priority issue, highlights a fundamental flaw in how the compiler handles covariant field assignments.
Why it matters
As Rust is widely used for memory-safe systems programming, such bugs can lead to undefined behavior and security vulnerabilities in critical infrastructure.
Code Issues 5k+ ( 5k+ ) Pull requests 1.4k ( 1.4k ) Actions Projects Security and quality 6 ( 6 ) Insights More items struct's lifetime requirements can be bypassed via covariant field assignment #164250 New issue Copy link New issue Copy link Open Open struct's lifetime requirements can be bypassed via covariant field assignment #164250 Copy link Labels A-borrow-checker Area: The borrow checker Area: The borrow checker A-destructors Area: Destructors (`Drop`, …) Area: Destructors (`Drop`, …) A-lifetimes Area: Lifetimes / regions Area: Lifetimes / regions A-variance Area: Variance (https://doc.rust-lang.org/nomicon/subtyping.html) Area: Variance (https://doc.rust-lang.org/nomicon/subtyping.html) C-bug Category: This is a bug. Category: This is a bug. I-unsound Issue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness Issue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness P-high High priority High priority T-types Relevant to the types team, which will review and decide on the PR/issue.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in