Rust borrow checker unsoundness lets references escape 'static bound after 11 years
Issue #164250 on the rust-lang tracker reports an unsoundness in the borrow checker: a short-lived reference escapes a T: 'static bound via field assignment after construction and is read after its stack slot is freed. It reproduces on stable and nightly, with variants compiling since 1.4 and 1.18.0 (2017). Severity was downgraded from P-critical to P-high because the exploit requires an intentionally malicious Drop implementation.
- Issue #164250: reference escapes T: 'static bound and is read after stack slot is freed
- Reproduces on stable and nightly; variants compile since 1.4 and 1.18.0 (2017)
- Severity downgraded from P-critical to P-high: requires a malicious Drop impl
- PR #164277 is the fix in motion
Read next
Software