Fast memory vulnerabilities, written in 100% safe Rust

2 pointsposted 6 hours ago
by airhangerf15

1 Comments

N_Lens

5 hours ago

Funnily this is satire/educational code - notice the license is "GLWTPL" (Good Luck With That Public License).

Repo is based on exploiting this bug - https://github.com/rust-lang/rust/issues/25860 (Open since 2015)

The bug allows you to "extend" any lifetime 'a to 'static in safe code:

This converts a reference with any lifetime into a 'static reference, which violates Rust's safety guarantees. Once you can do this, you can create dangling references, access freed memory, etc.

This is a type system bug, not just an implementation bug. From the discussions:

- The easy fix (banning contravariance in function arguments) would eliminate valid Rust programs

- The proper fix requires changes to how higher-ranked lifetime variables carry subtyping relations

- The Rust team chose to pursue the more rigorous solution as part of replacing the trait solver (the "Chalk" project)