Memory Safety Vulnerability in Rust Programming Language Standard Library

CVE-2019-12083

What is CVE-2019-12083?

The Rust Programming Language Standard Library prior to version 1.34.2 introduces a vulnerability where the stabilization of the 'Error::type_id' method allows overridden implementations to bypass Rust's stringent memory safety checks. This can lead to unsafe type casts, potentially resulting in memory corruption and data breaches. If overridden, this method permits casting any type to any other type without the usual safety guarantees, enabling issues such as out-of-bounds memory access. Code not implementing 'Error::type_id' remains unaffected, but developers should exercise caution with custom implementations to avoid introducing vulnerabilities into their applications.

References