Executive brief
Actix-web is a popular framework used to build high-performance web servers in the Rust programming language. Multiple flaws in how the framework handles computer memory could allow an attacker to cause a service crash or potentially execute unauthorized actions. These issues stem from improper internal shortcuts taken for performance that bypass Rust's standard safety guarantees.
Technical details
The actix-web framework contained several unsound uses of 'unsafe' Rust code prior to version 0.7.19. Specifically, the library was found to be coercing immutable references into mutable ones, incorrectly extending the lifetimes of string data, and incorrectly implementing the 'Send' trait on types that are not thread-safe (CWE-362). These flaws break Rust's memory safety guarantees and can result in use-after-free scenarios or race conditions. An attacker could potentially exploit these memory corruption issues via network requests to cause a denial-of-service (DoS) or achieve remote code execution, though the latter is significantly more complex in this context. The issues were addressed through a major refactoring of the codebase to remove or fix the unsound unsafe blocks.
Affected products
- actix actix-web < 0.7.19
Timeline
- 2018-06-08: disclosed: Initial tracking issue opened on GitHub
- 2021-08-25: advisory: GitHub Advisory published
- 2018-10-01: advisory: RustSec advisory issued