Microsoft Detects Stable Rust Bugs with Its AI

Researchers at Microsoft have uncovered several vulnerabilities in the standard library of Rust, two of which affect the stable version. One, related to process::exit, has reportedly been present for nearly 11 years. Microsoft deems the exploitation conditions to be unlikely, while patches are being proposed and reviewed. The findings also contribute to the company's in-house security tools.

Two vulnerabilities affect Rust stable, with patches under review

Two vulnerabilities discovered by Microsoft pertain to the stable version of Rust, particularly an issue that could lead to access to freed memory. The vulnerabilities involve the functions process::exit and CommandExt::exec. For the issue related to environment variable management, a patch that involves directly calling execve to avoid modifying the shared array was under review at the time of publication. Two other issues reported by the team remained open, and additional patches were also being considered. In some cases, concurrent operations could cause the environment pointer to reference freed memory.

Risk deemed low by Microsoft despite undefined behaviors

Microsoft believes that the practical risk posed by these vulnerabilities is limited. According to the company, each vulnerability requires unusual conditions to manifest, and a bug in the standard library only becomes serious if a real program uses the affected API in a specific way. The researchers did not identify any reliable exploitation paths in the scenarios studied and consider practical exploitation to be unlikely.

Detection powered by Hyenas, a derivative of MDASH

The analysis was conducted using Hyenas, an AI-based vulnerability detection system developed by Microsoft’s FORGE Lab, which serves as the research version of the MDASH system. Some bugs were identified using this tool. The researchers then examined the code, reproduced the issues, assessed their impact on security, and communicated their findings to the Rust maintainers.

Three families of vulnerabilities and concrete examples in the stdlib

The discovered vulnerabilities are grouped into three categories: insecure code assuming the absence of panic, code that trusts user-provided implementations, and code based on incorrect assumptions about the underlying system. An example from the first category involves MapWindows::clone, which allocated a buffer before its complete initialization and called a user-provided cloning operation; in the event of a panic, the unwinding mechanism could trigger a destructor accessing uninitialized memory. A modification has been submitted to prevent the destruction of a buffer that would not have been fully initialized. Regarding string APIs, str::replace was likely, in nightly version, to rely on an incorrect assumption about a custom implementation of the Pattern trait, which could generate invalid byte sequences concerning UTF-8 and cause undefined behavior in subsequent uses. The first two categories of weaknesses had already been analyzed in 2021 using the static tool Rudra, and the consideration of security issues related to panics began in 2015, although similar vulnerabilities persist in some versions.

System interactions: process::exit and environment variables

The vulnerabilities in the third category concern interactions between Rust, operating systems, and C libraries. The function process::exit has an old flaw: when called from a child thread, it can remove the alternative signal stack of the still-active main thread. If a stack overflow occurs afterward, the signal may not be delivered correctly, resulting in a segmentation fault instead of the expected handling. Researchers estimate that this bug has been present in the standard library for nearly 11 years. Additionally, CommandExt::exec could modify the shared state of environment variables while holding a read lock, exposing other threads to inconsistent data.

Insights feed into Microsoft Perception and Defender

Microsoft plans to use these findings in Microsoft Perception, a multi-agent security system, and to enhance the development of MDASH, integrated into Microsoft Defender for agent-based vulnerability discovery. The web application penetration testing agent can leverage these discoveries to prioritize testing, assess exploitability on production applications, and provide useful insights for remediation. The researchers indicate that they aim to identify significant issues and improve the security of foundational software.