11-Year-Old Unsoundness Bug Found in Rust Borrow Checker

Discovery of Long-Standing Bug

A P-high unsoundness bug has been identified in the Rust borrow checker. This issue, which has existed for 11 years, allows for the circumvention of a struct's lifetime requirements through covariant field assignment. The Rust Types Team considers upholding memory safety a priority and is actively working on fixes.

Technical Details and Exploitation

The bug's mechanism involves assigning a value to a covariant field, which can then be accessed in a `Drop` implementation with an incorrect assumed lifetime. While the bug appears easy to trigger, exploiting it to cause memory unsafety requires an intentionally malicious `Drop` implementation. The provided code example demonstrates how the program compiles and prints unexpected output, leading to a stack-use-after-scope crash with AddressSanitizer.

Impact and Severity Rating

Despite its age, the bug is rated P-high. The 'P-high' classification, rather than 'P-critical', is due to its long existence without being widely encountered, suggesting it is not easily triggered accidentally. The Rust team emphasizes that such bugs are taken seriously, regardless of real-world exploitation, and are part of ongoing efforts like Project Zero to minimize type system unsoundnesses.