Executive brief
actix-web is a popular framework used to build web servers and applications in the Rust programming language. A vulnerability was identified where the framework incorrectly handles memory management, potentially allowing a remote attacker to crash the server or execute unauthorized code. This could lead to service outages or the compromise of sensitive data handled by the web application.
Technical details
The actix-web crate (versions prior to 0.7.19) contains multiple memory safety issues stemming from the unsound use of 'unsafe' Rust code. Specifically, the framework could unsoundly extend the lifetime of a string, leading to an out-of-bounds write and subsequent memory corruption. Other related issues in these versions include the unsound coercion of immutable references to mutable ones and improper implementation of the 'Send' trait. These flaws can be exploited by a remote attacker over the network without authentication to achieve arbitrary code execution or a denial-of-service (use-after-free). The issues were addressed through a significant refactoring in version 0.7.19.
Affected products
- actix actix-web < 0.7.19
Timeline
- 2018-06-08: disclosed: Initial issue reported on GitHub
- 2021-12-27: advisory: NVD published CVE-2018-25025
- 2022-01-06: advisory: GitHub Advisory published