Rust Soundness Bug Lets Code Bypass Static Lifetime Bounds via Field Assignment

The Bug

A soundness hole in Rust's type system allows code to bypass a struct's 'static lifetime requirement through covariant field assignment. The issue, filed as rust-lang/rust#164250, involves a generic struct Q<T: 'static + Send> whose field can be assigned a reference to a short-lived local value. Because the field is covariant, the assignment is accepted even though the value does not meet the 'static bound. A Drop implementation for the struct then treats the stored reference as 'static, which can lead to use-after-scope reads of freed stack memory.

Impact and Severity

The reproducer compiles on current nightly builds and on stable releases at least as far back as 1.85.0, and one contributor reports the pattern has compiled since Rust 1.18.0 in 2017. Without sanitizers the program prints the contents of a freed string; under AddressSanitizer it crashes with a stack-use-after-scope error. Maintainer lcnr classified the issue as P-high rather than P-critical because it has gone undiscovered for 11 years, and because exploiting it requires an intentionally malicious Drop implementation rather than accidental misuse.

Response

The issue carries labels for the borrow checker, destructors, lifetimes, and variance, and is tracked by the Types Team. The team noted that fixing type system unsoundness is a large priority, alongside work on the next-generation trait solver, the region constraint rework, and Project Zero. A commit referencing the issue, titled "fix: refuse handles in aggregate storage on both front ends," was pushed shortly after the report. The GitHub thread was temporarily locked and limited to collaborators after attracting heated discussion.

Sources: Hacker News