Oscar 🇮🇪🇪🇦🇺🇸☘️✝️

Microsoft’s FORGE Lab identified several memory-safety issues in Rust's core and std libraries, including cases where code written entirely in safe Rust can trigger undefined behavior. msft.it/6017aCZh7 The research examines three recurring patterns of misplaced trust in unsafe code: trusting code not to panic, trusting user-provided implementations to be correct, and trusting the underlying system. Findings include issues affecting iterator cloning, string replacement, and interactions with the operating system. Using Hyenas, FORGE's research version of codename MDASH, researchers combined AI-assisted vulnerability discovery with technical investigation and validation. They investigated the underlying code, reproduced the bugs, assessed potential security impact, and worked with Rust maintainers to report and fix them. While Rust's ownership model and type system prevent entire classes of memory-safety vulnerabilities, unsafe implementations underneath safe APIs must still uphold those guarantees. The findings illustrate how subtle mistakes in foundational libraries can lead to undefined behavior, and why Rust's safety model remains important even when bugs are discovered. Read the analysis for details on the findings, root causes, upstream fixes, and lessons for developers working with unsafe Rust.