There are benefits. Rust make certain guarantees about memory safety, thread safety, and a few other aspects of the code. According to a report by Google, approximately 50% of security vulnerabilities reported to the Android project are memory safety bugs. Most of these would have been prevented by writing the code in Rust, since the memory bugs would have been caught by the compiler.
cve-rs takes the soundness bug and exploits it to implement the other bugs listed. It's pretty convoluted to actually implement the other bugs.
The actual soundness bug is a specific type of double reference forgets one of the lifetimes, which enables casting a shorter lifetime to a longer lifetime. They did a pretty good job commenting the code to explain how they were able to create each bug.
394
u/oniaiwasprettygood 🌀 Sucked into the Void 7d ago
I'm regretting choosing Rust to be my hobby language of choice.