RUSTSEC-2026-0097None▾ SunlitRand is unsound with a custom logger using `rand::rng()`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
It has been reported (by @lopopolo) that the rand library is unsound (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
log and thread_rng features are enabledrand::rng() (previously rand::thread_rng()) and calls any TryRng (previously RngCore) methods on ThreadRngThreadRng (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)getrandom crate) is unable to provide a new seedTryRng (previously RngCore) methods for ThreadRng use unsafe code to cast *mut BlockRng<ReseedingCore> to &mut BlockRng<ReseedingCore>. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of aliased mutable references is Undefined Behaviour, the behaviour of optimized builds is hard to predict.
rand >= 0.10.0, < 0.10.1Upgrade to a patched release:
rand 0.10.1Connected by shared product, vendor, weakness, or advisory.