Microsoft AI Uncovers 11-Year-Old Rust Bug, Flags 2 Stable-Library Memory Flaws

2 articles · Updated · InfoWorld · Nov 10

Microsoft’s FORGE Lab said its Hyenas AI system helped uncover a Rust standard-library bug that sat undetected for nearly 11 years, plus other flaws that can trigger undefined behavior even in safe Rust code.
Two findings affect stable Rust: one in process::exit can tear down the main thread’s alternate signal stack from a child thread, and another in CommandExt::exec can leave environment data pointing to freed memory.
Microsoft said practical exploitation appears limited because the bugs require unusual conditions, and it found no reliable exploitation path for the process::exit issue under the scenarios it tested.
The research focused on unsafe code inside Rust’s standard library, where soundness can fail through panic handling, trust in user-provided implementations, or incorrect assumptions about operating systems and C libraries.
Some fixes were already proposed or under review when the blog was published, and Microsoft said the findings will also be used to sharpen MDASH and Microsoft Defender’s agentic vulnerability-discovery workflows.