Memory Safety Bugs in Rust Standard Library(forge-blog.github.io)
Researchers at Microsoft's FORGE Lab have discovered several memory safety bugs in Rust's standard library, including cases where safe Rust code can trigger undefined behavior, using an AI-powered vulnerability-scanning system called Hyenas. The findings reveal three patterns of misplaced trust in unsafe code: trusting code not to panic, trusting user-provided implementations, and trusting the underlying system. Despite Rust's robust safety guarantees, which rule out many memory-safety issues through its type system and ownership model, the standard library's reliance on underlying unsafe code can still lead to safety breaches, highlighting the importance of Rust's safety model and the need for continued vigilance in ensuring memory safety.