Executive brief
actix-web is a popular framework used to build high-performance web servers in the Rust programming language. A security flaw was identified where the framework incorrectly handles internal data references, potentially allowing an attacker to corrupt the server's memory. This could lead to system crashes, unauthorized data access, or the execution of malicious code on the server.
Technical details
The actix-web crate prior to version 0.7.19 contains several unsound uses of 'unsafe' Rust code. Specifically, the framework was found to unsoundly coerce immutable references into mutable references, incorrectly extend the lifetimes of strings, and inappropriately apply the 'Send' marker trait to objects that are not thread-safe. These flaws break Rust's memory safety guarantees, potentially leading to out-of-bounds writes and use-after-free vulnerabilities. An attacker could exploit these issues via network requests to cause memory corruption, leading to arbitrary code execution or a denial-of-service (DoS) condition. The issues were addressed through a significant refactoring of the codebase to remove or secure unsafe blocks.
Affected products
- actix actix-web < 0.7.19
Timeline
- 2018-06-08: disclosed: Initial tracking issue for unsound unsafe usage opened
- 2018-06-08: patched: Version 0.7.19 released with fixes
- 2021-12-27: advisory: NVD published CVE-2018-25024
- 2022-01-06: advisory: GitHub Advisory published