RUSTSEC-2025-0030 totally-safe-transmute allows transmuting any type to any other type in safe Rust
The totally-safe-transmute crate allows unsafe memory manipulation via /proc/self/mem, enabling arbitrary code execution or privilege escalation in safe Rust.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2025-0030?
RUSTSEC-2025-0030 is a memory corruption vulnerability in totally-safe-transmute, published on 10 Feb 2025.
Official description
This crate is a toy and should never be used.
It showcases a known soundness issue (https://github.com/rust-lang/rust/issues/32670) that will never get fixed. In short, Linux provides a file called /proc/self/mem which can be used by a program to modify its own memory. This library modifies an enum variant number by accessing its own memory as a file to effectively transmute a variable.
See also <https://doc.rust-lang.org/std/os/unix/io/index.html#procselfmem-and-similar-os-features>
Which versions are affected by RUSTSEC-2025-0030?
1 open source package ship an affected version, including totally-safe-transmute.
| Package | Affected | Fixed in |
|---|---|---|
totally-safe-transmute crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2025-0030?
No fix has been published for RUSTSEC-2025-0030 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2025-0030 being exploited?
There is no known exploitation of RUSTSEC-2025-0030 in the wild and no public exploit code.