Microsoft FORGE Lab Uncovers Memory Safety Flaws in Rust Standard Library Using AI

Microsoft's FORGE Lab has identified several memory safety issues within Rust's standard library, demonstrating that even code written entirely in safe Rust can trigger undefined behavior. The research, conducted using Hyenas, an AI-powered vulnerability-scanning system, uncovered recurring patterns of misplaced trust in the underlying unsafe code that underpins Rust's safe APIs.

These findings are particularly significant given Rust's increasing adoption in critical software and its strong reputation for memory safety. Languages like Rust are chosen for their ability to prevent entire classes of bugs, such as buffer overflows and use-after-free errors, through features like its type system and ownership model. However, much of the standard library relies on unsafe blocks to interact with lower-level system functionalities, and it is within these blocks that vulnerabilities can emerge.

The FORGE Lab's research highlighted three primary patterns of misplaced trust: trusting code not to panic, trusting user-provided implementations to be correct, and trusting the underlying system. The first pattern, 'trusting code not to panic,' is critical because Rust's default panic unwinding mechanism can leave unsafe code in an inconsistent state if a panic occurs during its execution. This can lead to memory safety violations that the language is designed to prevent.

The second pattern, 'trusting user-provided implementations to be correct,' arises when unsafe code relies on external implementations, such as those provided by users through traits like AsRef. If these implementations do not adhere to the expected contracts—for instance, by returning different slice lengths on successive calls—the unsafe code can be led into accessing memory out of bounds.

Finally, 'trusting the underlying system' involves unsafe code making assumptions about the behavior of the operating system or hardware that may not always hold true. These assumptions, if violated, can also lead to exploitable memory safety issues. The research team noted that upholding the soundness of safe APIs built upon unsafe foundations is a complex challenge.

Microsoft has been actively involved in Rust security research, building on previous work like the Rudra static analyzer. The FORGE Lab's current investigation into the standard library aims to understand the types of mistakes that still occur in unsafe code. While Rust's memory safety is not perfect, the researchers emphasize that the language's guarantees remain vital for building secure software, especially as Rust is adopted by major tech companies and integrated into operating systems and critical infrastructure.

The findings were reported to the Rust issue tracker, with maintainers actively triaging and addressing the reported vulnerabilities. The research underscores the ongoing need for rigorous security analysis, even in languages renowned for their safety, and highlights the potential of AI-assisted tools in uncovering complex bugs.