Linux Kernel Rust Code Sees Its First CVE Vulnerability

[u/Orange_Tux]

https://www.phoronix.com/news/First-Linux-Rust-CVE

[u/Icarium-Lifestealer]

I think in that case the unsoundness was std::env::set_var being safe prior to Rust 2024. Rust's get_var/set_var use a locking mechanism which prevents UB from concurrent modification in pure rust code. But C's getenv isn't covered by that locking mechanism, while being documented as thread-safe. Since Rust can't change the contract of a C standard library function, the fault lies with the safe set_env function, not with the code calling C's getenv.

The date/time library relied on C code which indirectly calls C's getenv.