rust-stdlib

Rust Standard Library Audit Findings

Security audit of the Rust standard library and supporting crates. Each finding includes a detailed write-up and a patch.

Summary

Total findings: 151 -- High: 27, Medium: 115, Low: 9

Findings

std::sys::pal

#	Finding	Severity
004	stale handle count sets Vec length	Medium
005	Zero-Length Device Path Stalls Iterator	Low
006	File Name Length Underflow	Medium
011	Unmapping Active Alternate Stack	Medium
062	UNICODE_STRING Length Truncation	Medium
071	Shared Slice Reference Over Mutable Userspace	High
072	Exclusive Slice Reference Over Nonexclusive Userspace	High
105	Signed Minimum Negation Overflows	Medium
106	i32 Minimum Negation Overflows	Medium
107	Spin Mutex Bypasses Inter-Core Lock	High
142	sockaddr_storage too small for IPv6	High
145	Unchecked Alignment Forms Invalid Layout	Medium
146	zero new size reaches realloc	Medium
147	Unchecked Parameter Length Creates Static Slice	High
167	null pointer passed to from_raw_parts	Medium
168	Oversized Timeout Becomes Infinite Wait	Medium
190	Wrapped Enclave Limit Permits Enclave Pointers	Medium
192	Unchecked SGX Read Length Slices User Buffer	Medium
193	unchecked read length slices enclave cursor	Medium
194	Movable Self-Referential List Pointer	High

std::sys::net

#	Finding	Severity
007	async completion status read from stale copy	Medium
021	Unchecked Receive Length Panics	Medium
022	read reports uncopied bytes	Medium
023	write reports excess bytes	Medium
041	accept can orphan rebound listener fd	Medium
042	accept ignores response length	Medium
049	Panic on Empty Connect Addresses	Medium
050	Panic on Empty Listener Bind Addresses	Medium
051	Panic On Empty UDP Bind Addresses	Medium
052	unchecked receive length panics	Medium
053	receive length overreports copied bytes	Medium
138	accept masks invalid peer address	Medium
139	IPv6 DNS record parsing skips first byte	Medium
140	IPv6 DNS Record Boundary Check Permits Panic	Medium
141	Oversized DNS Query Length Forwarded	Medium

std::sys::fs

#	Finding	Severity
008	Unchecked Reparse Name Bounds	Medium
009	unchecked directory name length	Medium
018	unchecked dirent header length	High
019	Unbounded Directory Name Scan	High
020	remove_dir_all follows dot entries	High
030	Volume Handle Leak In from_path	Medium
031	Existence Check Leaks Opened Handle	Medium
032	Created Directory Handle Leak	Medium

std::sys::process

#	Finding	Severity
012	Spawned Child Leaked On pidfd PID Lookup Failure	Medium
025	Early Error Leaves Redirected Stdio	High
075	Environment Rollback Skipped On Start Failure	Medium
108	stderr uses stdout configuration	High
110	callback error leaks stdio descriptors	Medium

std::sys::thread

#	Finding	Severity
043	Stack Rounding Addition Overflows	Medium
044	stack mapping length overflows	Medium
170	unchecked NonZero construction	Medium
172	Recursive TLS Initialization Invalidates Returned Pointer	Medium

std::sys::stdio

#	Finding	Severity
076	Saved Surrogate Triggers Out-Of-Bounds Slice	Medium
077	Pending stdin bytes overwritten	Medium
121	Oversized Panic GFX Lend Valid Length	Medium
153	Unchecked Vectored Write Length Sum	Medium
195	read count exceeds buffer length	Medium
196	unchecked ABI length advances cursor	High

std::sys::sync

#	Finding	Severity
111	timeout can exceed waiter counter	High
112	wait error leaves mutex unlocked	Medium
113	notify error loses waiters	Medium
114	Contended Mutex Wait Path Lacks Acquire Synchronization	High

std::sys::personality

#	Finding	Severity
148	Unchecked Call-Site Table Length Pointer Add	High
150	LSDA-Controlled Indirect Pointer Dereference	High
151	Oversized ULEB128 Invalid Shift	Medium
152	oversized SLEB128 invalid shift	Medium

std::sys::alloc

#	Finding	Severity
061	realloc uses mismatched allocation predicate	Medium
069	Unchecked C Allocation Layout	Medium
070	Unchecked C Deallocation Layout	Medium
102	realloc used on memalign allocation	Medium

std::sys::env

#	Finding	Severity
103	Unsynchronized Global Pointer Dereference	Medium
104	Global Environ Pointer Advanced During Enumeration	Medium
188	allocation overflow creates undersized buffer	High

std::sys::args

#	Finding	Severity
086	null load_options slice creation	Medium
137	Negative argc Becomes Huge Slice Length	High
187	unchecked argv length rounding overflow	Medium

std::sys (other)

#	Finding	Severity
034	RDRAND target feature skips AMD blacklist	Medium
074	Interior NUL Truncates Windows chdir Path	Medium
087	drive-only path skips absolutization	Medium
088	Unchecked Firmware Timestamp Frequency	Medium

std::os::unix

#	Finding	Severity
013	unchecked read_exact_at offset addition	Medium
014	unchecked read_buf_exact_at offset addition	Medium
015	unchecked write_all_at offset addition	Medium
029	Vectored UnixStream Writes Omit SIGPIPE Suppression	Medium
135	Oversized Unix Socket Address Length Panic	Medium

std::os::windows

#	Finding	Severity
016	Missing Default SQOS On Windows Opens	Medium
066	Socket Clone Inheritance Race In Fallback Path	Medium
136	NUL Bytes Accepted in Pathname	Medium

std::os::xous

#	Finding	Severity
040	Long Service Names Are Silently Truncated	Medium

std::os::uefi

#	Finding	Severity
060	Public Globals Allow Arbitrary Pointer Dereference	High

std::io

#	Finding	Severity
059	Unchecked Oversized Write Count In BufWriter Flush	Low
132	Vectored Write Count Overflow	Medium
133	Unchecked Empty Vectored Length Sum	Medium
134	unchecked Sink vectored length sum	Medium

std::sync

#	Finding	Severity
068	write downgrade skips poison finalization	Medium

std (panicking)

#	Finding	Severity
002	resume_unwind ignores required abort	Medium

stdarch

#	Finding	Severity
079	Secrets Passed To Mutable External Workflow	Medium
090	Out-of-Range SIMD Insert Index	Medium
091	Out-of-Range SIMD Extract Index	Medium
092	Unencoded VSX Store Length	Medium
094	Unsanitized Argument Name In Generated Identifiers	Medium
095	Safe RCpc Store Dereferences Raw Pointer	High
096	Safe Typed RCpc Stores Erase Pointer Type	High
097	Unsupported Parameters Are Silently Omitted	Medium
156	signed immediate lower bound off by one	Medium
158	svld2_vnum omits vnum offset safety	Medium
159	svld3_vnum omits vnum offset safety	Medium
160	svst1_vnum omits vnum offset safety	Medium
173	cargo argument injection via environment	Medium
197	rustflags argument injection via linker	Medium
198	Generated Rust Injection Via Intrinsic Name	Medium

std_detect

#	Finding	Severity
035	Wrong Extended CPUID Max Check	Medium
036	avx10_2 ignores avxvnniint16 presence	Medium
037	unchecked CPUID 0x24 query	Medium
063	SIMD Extensions Ignore SIMD Invariant	Medium
154	Unchecked Value Access in auxv Chunk	Low
155	unchecked hwcap value access	Low

core

#	Finding	Severity
058	Raw Slice Split Length Underflow	Medium
098	Non-Static TypeIds Cross Public API Boundary	Medium
099	Unchecked Cached Power Index	Low
178	Zero-Sized Elements Skipped During Drain Drop	Medium
179	Clamp get underflows on empty slice	Low
180	Inclusive Clamp Get Underflows On Empty Slice	Low
181	Inclusive RangeTo Clamp get Underflows On Empty Slice	Low
182	unchecked isize widening arithmetic overflows	Medium
183	Out-of-bounds write for zero-sized chunks	High
184	Zero-Length Chunk Writes Out Of Bounds	High
185	panic during clone drops uninitialized elements	High

compiler-builtins

#	Finding	Severity
001	Unsafe Tar Extraction	Medium
038	small UEFI probes corrupt saved frame pointer	Medium
045	unchecked exponent digit accumulation	Medium
046	Unchecked Mantissa Exponent Growth	Low
056	C ABI uses Rust reference for lgamma_r sign pointer	Medium
057	C ABI uses Rust reference for lgammaf_r sign pointer	Medium
064	Unpinned Remote Git Dependencies	Medium
083	subword RMW writes adjacent bytes	High
084	subword compare-exchange writes adjacent bytes	High
127	Unverified Compiler-RT Download	Medium

test harness

#	Finding	Severity
117	Unescaped JUnit XML Attribute Values	Medium
118	Unescaped Failure Message XML Attribute	Medium
119	Terminal Name Path Traversal	Medium
164	Unchecked Terminfo String Offset Panics	Medium
165	Truncated String Table Panics	Medium
174	Unescaped Ignore Message In Discovery JSON	Medium
199	unchecked parameter index underflows	Medium
200	unchecked division by zero	Medium
201	unchecked modulo by zero	Medium

portable-simd

#	Finding	Severity
085	Mutable Remote Helper Executed	Medium
131	Unpinned Network Installer Executes As Shell	Medium

profiler_builtins

#	Finding	Severity
028	cargo directive injection via library filename	Medium

unwind

#	Finding	Severity
202	Invalid Reference From Instruction Pointer	High