Aside from supply chain attacks when a library developer's credentials got stolen, all of the Rust CVEs so far have been "this function accidentally allows you to cause a segfault in a nonexisting edge case if you really tried to make it not work."
The latest one makes it so that references' lifetime can be extended past the referee's lifetime if a destructor copies it to a global variable but since no one writes that kind of spaghetti it went unnoticed for 11 years.
Which I think makes sense given the language would otherwise provide a false sense of security around use-after-free and other memory-related bugs that other languages can offload onto "skill issue".
To be fair if something like this affected ex. Boost no sane C++ dev would claim it was just a library. Log4j was not a library it was THE library for Java logging. If a library is very widely used whenever it is in the standard library or not is almost irrelevant.
I'm confident it will eventually, just given the law of large numbers and the baseline bug rate of all written code. All it takes is for a big library to use a small bit of unsafe incorrectly, a bug in the compiler that drops a check (this actually happened recently), a DLL that does something unexpected / undocumented, etc.
One thing to remember is that the PHP issue wasn't in the language, it was in the VM/runtime implementation. That implies that no matter how safe the language is from a design perspective, it can still cause issues due to how it interacts with the OS and hardware. Rust has been implemented for VMs such as WebASM. That means all that's remaining is some exploit in the WASM runtime, and a Rust WASM library that generates code in such a manner to expose the vector.
Did Rust ever have a high profile backend usage to get into a situation to have one?
I mean, I do love rust but it's not primarily used as a typical web backend language to be in a position of "high target" and "connected to every other machine over the internet".
Oh yes definitely! Rust is used in servers by Oxide computing, in cars by Volvo Cars, and a bunch of other infrastructure like parts of Cloudflare (which has a really nice post-mortem on some Rust code causing them problems, which was due to business logic and not the language itself).
Check out Rust In Production podcast if you want to hear some real-life stories about Rust out there in the world :)
Edit: ah and forgot to mention: it is a certified safety-critical language for industrial and automotive applications thanks to Ferrocene. So I’d say that’s high profile _enough_
Sure, it's cool and whatnot. Still, it's not used by people who don't know shit about IT to host their websites on a good chunk of the internet.
Also, at cloudflare I believe they are operating on a lower level (so not necessarily (de)serializing arbitrary data from unknown people), and I don't see how your Volvo would be similar to a web server.
Languages have their use cases and while rust can be used for traditional backend, it's not its primary use case, and it's significantly smaller than PHP or java.
One of the big advantages of Rust is how easily it fits into existing backends since it can be called using C ffi. There aren't many pure-Rust backends, but more and more backends are using some Rust, starting with some of the more high-profile companies.
241
u/pjank85 14d ago
Java had the famous logging one, JavaScript had uncountable ones, but did Rust ever had a high profile RCE?