GHSA-8xw8-mmqv-frqq fake-static allows converting any reference into a `'static` reference
The fake-static crate allows unsafe lifetime coercion, potentially leading to memory corruption and code execution in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-8xw8-mmqv-frqq?
GHSA-8xw8-mmqv-frqq is a vulnerability in fake-static, published on 24 Apr 2020.
Official description
fake-static allows converting a reference with any lifetime into
a reference with 'static lifetime without the unsafe keyword.
Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc:
Which versions are affected by GHSA-8xw8-mmqv-frqq?
3 open source packages ship an affected version, including fake-static.
| Package | Affected | Fixed in |
|---|---|---|
fake-static crates.io | All versions to 0.1.0 | None |
fake-static crates.io | All versions to 0.1.0 | None |
fake-static crates.io | From 0.0.0-0 | None |
How do I fix GHSA-8xw8-mmqv-frqq?
No fix has been published for GHSA-8xw8-mmqv-frqq yet. Limit exposure of the affected software until one is available.
Is GHSA-8xw8-mmqv-frqq being exploited?
There is no known exploitation of GHSA-8xw8-mmqv-frqq in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2020-0013.