11 year old unsoundness bugs found in Rust borrow checker
Points and comments are a snapshot, not live.
An 11-year-old unsoundness bug in Rust's borrow checker allows safe code to violate lifetime guarantees.
A new GitHub issue reports that Rust's borrow checker fails to enforce `'static` lifetime bounds on struct fields when the struct implements `Drop`. The bug allows a non-`'static` reference to be stored in a field that requires `'static`, and the `Drop` implementation can then access the reference after the referent has been dropped, causing use-after-free. The minimal reproducer has been compiler-accepted since Rust 1.18.0 (2017). The issue is labeled P-critical (highest priority) and involves covariance of field assignment, variance, and destructors. Multiple contributors confirm the unsoundness and provide simplified examples that do not rely on a static global.
What commenters are saying
Commenters express shock at the simplicity of the exploit, noting the minimal reproducer could easily appear in normal code. Two camps emerge: those who say the bug is severe because custom `Drop` implementations are common in production (especially with FFI), and those who argue its rarity is proven by the decade it went undiscovered. Some speculate the root cause lies in covariance handling during field assignment. Others note similar unsoundness issues have existed historically (e.g., `loop {}` being UB). A commenter points out that Ferrocene, the safety-certified Rust compiler, uses the same codebase and is likely affected.