N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-cq8v-f236-94qc

GHSA-cq8v-f236-94qc: Rand is unsound with a custom logger using rand::rng()

It has been reported (by @lopopolo) that the rand library is unsound (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:

The log and thread_rng features are enabled
A custom logger is defined
The custom logger accesses rand::rng() (previously rand::thread_rng()) and calls any TryRng (previously RngCore) methods on ThreadRng
The ThreadRng (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
Trace-level logging is enabled or warn-level logging is enabled and the random source (the getrandom crate) is unable to provide a new seed

TryRng (previously RngCore) methods for ThreadRng use unsafe code to cast *mut BlockRng<ReseedingCore> to &mut BlockRng<ReseedingCore>. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of aliased mutable references is Undefined Behaviour, the behaviour of optimized builds is hard to predict.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-cq8v-f236-94qc

GHSA-cq8v-f236-94qc:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rand	rust	= 0.10.0	0.10.1
rand	rust	>= 0.9.0, < 0.9.3	0.9.3
rand	rust	>= 0.7.0, < 0.8.6	0.8.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a soundness issue in the rand crate that can lead to Undefined Behavior. It occurs under a specific set of conditions: the log and thread_rng features are enabled, a custom logger is in use, and that logger calls back into rand::rng()'s methods. The root cause is re-entrancy. When ThreadRng needs to reseed itself (after generating 64KB of data), it calls the internal ReseedingCore::try_to_reseed function. In vulnerable versions, this function contained logging calls (trace! and warn!). If a custom logger is active, these logging calls would execute the custom logger's code. If this logger code, in turn, calls any of the RngCore or TryRng methods on ThreadRng, it creates a re-entrant call. This re-entrancy leads to the creation of a second mutable reference to the internal RNG state while the first one is still active on the call stack, violating Rust's borrowing rules and causing Undefined Behavior. The fix applied in the patch is to completely remove the log feature and its associated logging calls from the try_to_reseed function, replacing a warn! with a panic!. This eliminates the possibility of a re-entrant call through the logging system. The primary vulnerable function is rand::rngs::thread::ReseedingCore::try_to_reseed as it contained the logging calls that enabled the vulnerability.

Vulnerable functions

rand::rngs::thread::ReseedingCore::try_to_reseed

src/rngs/thread.rs

The vulnerability is due to a soundness issue where a re-entrant call could be triggered. The function `try_to_reseed` used logging macros (`trace!` and `warn!`). When a custom logger is configured for the `log` crate, these macros would invoke the custom logger. If the custom logger itself calls any `rand::rng()` methods, it leads to a re-entrant call to the `ThreadRng` methods, which can cause a re-entrant call to `try_to_reseed`. This creates an aliased mutable reference to the RNG state, which is Undefined Behavior in Rust. The patch removes the logging calls from this function, replacing the warning with a panic, thus closing the re-entrancy vector.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.