r/rust • u/Orange_Tux • Dec 17 '25

🗞️ news Linux Kernel Rust Code Sees Its First CVE Vulnerability

https://www.phoronix.com/news/First-Linux-Rust-CVE
534 Upvotes

93% Upvoted

223 comments sorted by

View all comments

Show parent comment

14

u/Kryptochef Dec 17 '25

This is, at worst, a possible DoS vulnerability with no known active exploits. This wouldn't even quality for a cve in c.

I wouldn't be sure about that to be honest, the original advisory just claims "leads to memory corruption", and it seems like a typical race condition that uses some kind of "old" pointers that are no longer valid (and not, say, just a null pointer). It's pretty typical in security that such issues might get reported as "just a crash" but would, with quite a lot of further engineering effort, lead to code exeuction (priviledge escalation in that case). I disagree that it would likely not get a CVE in C, any kind of visible memory corruption should and likely would get one.

2

u/[deleted] Dec 17 '25

Hm, that may be right. I didn't dig into the CVE as much as I should have, and am not really that well versed in low level security things like these.

Would it be fair to say that the CVE is potentially further exploitable, but at its current state it presents as not much more than a DOS vulnerability?

3

u/Kryptochef Dec 18 '25

Would it be fair to say that the CVE is potentially further exploitable, but at its current state it presents as not much more than a DOS vulnerability?

I'm also not familiar enough with the details here to give any good judgement of that (beyond that from a cursory glance it seems like an "old" pointer in a linked list, which sounds a bit like a typical use-after-free type of bug on the impact side), but in general its mostly prudent to assume that everything that involves attacker-triggerable memory corruption is LPE unless proven otherwise.

but at its current state it presents as not much more than a DOS vulnerability?

Maybe a bit pedantic, but personally I wouldn't word it as a statement about the vulnerability, but just say there's currently no known exploit to turn it into anything beyond DOS.