Bugs Rust won't catch (corrode.dev)

Article summary

The article discusses a security audit of the uutils project, a Rust reimplementation of GNU coreutils, which revealed 44 CVEs. The bugs were not caught by Rust's borrow checker or other safety features, and were caused by incorrect usage of Unix APIs and semantics. The article highlights several examples of bugs, including time-of-check-to-time-of-use (TOCTOU) bugs and issues with file descriptor handling. The author emphasizes the importance of understanding Unix APIs and semantics when writing systems code in Rust.

Main themes

• Rust security
• Unix API pitfalls
• Filesystem security
• Systems programming
• Language design

What commenters say

• Rust's standard library is too low-level and prone to mistakes, particularly when it comes to filesystem access and Unix APIs.
• The Rust standard library should provide a safer, higher-level API for file and directory operations to prevent common mistakes.
• Exposing low-level, platform-specific APIs like openat can be error-prone and may not be the best solution for a cross-platform language like Rust.
• Writing a custom library that wraps the Rust standard library with a file-handle-based API can help prevent common mistakes and improve security.
• Rust's standard library is too Unix-centric and may not be suitable for programming on non-Unix environments, such as Windows or microcontrollers.
• The lack of support for certain features like ACLs and file descriptors in the Rust standard library is a limitation, but may be addressed through platform-specific libraries or extensions.