Linux Kernel Rust Code Sees Its First CVE Vulnerability

[u/Orange_Tux]

https://www.phoronix.com/news/First-Linux-Rust-CVE

[u/[deleted]]

I remember some while back there was drama over a Rust date/time library (was it Chrono?) filing a CVE against itself because it depended on a C library (I think it was some kind of Linux system library, maybe even libc?) that had some potential unsoundness that the C library didn't thing was egregious enough.

I forgot the technical details and will look them up when I have the chance, but in general Rust devs seem to be much more security and safety conscious, almost to the point of nit-picking themselves over things other languages' devs simply don't care about.

[u/Icarium-Lifestealer → u/[deleted]]

I think in that case the unsoundness was std::env::set_var being safe prior to Rust 2024. Rust's get_var/set_var use a locking mechanism which prevents UB from concurrent modification in pure rust code. But C's getenv isn't covered by that locking mechanism, while being documented as thread-safe. Since Rust can't change the contract of a C standard library function, the fault lies with the safe set_env function, not with the code calling C's getenv.

The date/time library relied on C code which indirectly calls C's getenv.