Microsoft FORGE Lab finds memory-safety bugs in Rust’s standard library
Original title: FORGE Lab uses agentic tools to identify memory safety issues in Rust
Some bugs let entirely safe Rust trigger undefined behavior; two reported issues were still open at publication.
Microsoft’s FORGE Lab reported memory-safety issues in Rust’s std and core libraries, including cases where code written only in safe Rust can trigger undefined behavior. Researchers used Hyenas, a research version of codename MDASH, then reproduced the bugs and reported them to Rust maintainers. The post describes three patterns of misplaced trust in unsafe code. Two of the team’s reported issues remained open when the article was published.
Unconfirmed: Two issues reported by the team remained open at publication, and no CVE identifiers are given.
- Patterns cover panics, user-provided implementations and trust in the underlying system.
- The post covers standard-library soundness bugs, not compiler miscompilations.
- One cited panic-safety bug is MapWindows::clone, issue 156501.
- Rust maintainers triaged the reports quickly, the lab said.
Impact: Safe Rust can trigger undefined behavior
| Product | Affected |
|---|---|
| Rust standard library (std and core) | — |
- Products
- Rust standard library
- Organizations
- Microsoft
From the original article
14 min read at microsoft.com
Microsoft FORGE Lab researchers found memory-safety bugs in Rust's core and std libraries, including cases where safe Rust code can trigger undefined behavior. Using Hyenas, FORGE's frontier research version of codename MDASH, the team investigated three patterns of misplaced trust in unsafe code and what they reveal about Rust's safety guarantees.
By Yechan Bae and FORGE Lab · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.