Executive brief
actix-web is a popular framework for building web applications in the Rust programming language. A vulnerability was identified where the software incorrectly handles data across different processing threads, which can lead to memory corruption. This could allow a remote attacker to crash the web server or potentially execute unauthorized code, impacting the availability and security of the hosted application.
Technical details
The actix-web crate prior to version 0.7.19 contains multiple memory safety issues stemming from unsound use of 'unsafe' blocks. Specifically, the library incorrectly applied the 'Send' marker trait to objects that are not thread-safe, allowing them to be transferred across thread boundaries. This violation of Rust's memory safety guarantees can result in out-of-bounds writes, use-after-free conditions, and general memory corruption. An attacker can exploit these flaws over the network without authentication to cause a denial of service or achieve remote code execution. The issues were addressed through a significant refactoring of the codebase to remove unsound unsafe operations.
Affected products
- actix actix-web < 0.7.19
Timeline
- 2018-06-08: disclosed: Initial report of unsound unsafe usage in actix-web issue tracker
- 2021-12-27: advisory: NVD published CVE-2018-25026
- 2022-01-06: advisory: GitHub Advisory GHSA-7x36-h62w-vw65 published