11 year old unsoundness bugs found in Rust borrow checker

Rust's compiler now accepts code that has undefined behavior, meaning memory safety is not guaranteed.

A critical soundness bug, present for at least 11 years and affecting stable Rust versions down to 1.85.0, has been discovered in the Rust borrow checker. The bug allows a program to compile and run, but with undefined behavior leading to a use-after-scope memory error, which is detectable with AddressSanitizer. The issue arises from a pattern involving a struct that holds a reference, a custom `Drop` implementation that stores the referenced data in a static `Mutex<Vec<Box<dyn Any>>>`, and a scope where the reference goes out of scope but the data it points to is later accessed. This incorrect memory access leads to a crash when ASan is enabled, demonstrating a fundamental flaw in Rust's memory safety guarantees that has gone undetected for over a decade.

This critical soundness bug, which has persisted for over a decade, fundamentally undermines Rust's core promise of memory safety. The borrow checker, a cornerstone of Rust's compile-time guarantees, has failed to prevent a scenario leading to a use-after-scope vulnerability. This discovery suggests a deeper architectural flaw or oversight in the borrow checker's logic, potentially impacting the trustworthiness of existing Rust codebases that rely on these guarantees. The fact that the issue remained undetected for so long also raises questions about the effectiveness of Rust's internal auditing and testing processes for its most critical components.

The implications extend to all Rust developers, as code previously considered safe may now harbor hidden memory safety issues. While the bug is explicitly demonstrated with a specific pattern involving `Drop` implementations and static references, it highlights the potential for other, yet undiscovered, soundness flaws. Teams should exercise increased caution, and potentially re-evaluate critical sections of their code, especially those relying on complex lifetime interactions or manual memory management patterns. The Rust security team's response and any subsequent fix will be closely watched, as will any potential impact on the language's reputation and adoption.