11-Year-Old Soundness Bug Found in Rust Borrow Checker
Original: 11 year old unsoundness bugs found in Rust borrow checker
Why This Matters
Soundness bugs in Rust undermine its core safety guarantee used across systems and security-critical software.
A critical soundness bug (CVE pending) in Rust's borrow checker, open since ~2015, lets struct lifetime requirements be bypassed via covariant field assignment, enabling potential memory unsafety without unsafe code.
A newly filed GitHub issue (#164250) exposes a long-standing soundness hole in Rust's borrow checker: struct lifetime requirements can be bypassed through covariant field assignment, meaning safe Rust code could produce memory-unsafe behavior the type system was explicitly designed to prevent. The bug is labeled P-high (and noted it would have been P-critical regardless of real-world exploitation). The Rust Types Team confirmed awareness and pointed to ongoing mitigation work: the next-generation trait solver, a region constraint rework, and the broader Project Zero initiative, all aimed at eliminating type system unsoundnesses systematically. The issue attracted significant online attention shortly after filing, prompting the team to add a public note with extra context. No patch or workaround has been announced yet. Rust's core value proposition—memory safety without a garbage collector—makes this class of bug particularly damaging to perception, even if exploitation in the wild remains unconfirmed.