repository·main·Indexed 26 days ago
https://github.com/speykious/cve-rsA Rust library (version 0.7.0) written in 100% safe Rust that allows developers to intentionally introduce and simulate common memory vulnerabilities, such as buffer overflows, segmentation faults, and use-after-free, without using `unsafe` code. It provides safe reimplementations of `std::mem::transmute` and null pointers, supports WASM via the WASI API, and includes a CLI for demonstrating these vulnerabilities.
cve-rs allows you to introduce common memory vulnerabilities into a Rust program in a 100% memory-safe manner (using #![deny(unsafe_code)]). It is designed to simulate memory corruption without actually violating Rust's safety guarantees.
The project supports WASM via the WASI API and WebAssembly for browsers. To compile and run the example using Wasmer, use the following commands:
cargo build --target wasm32-wasi
wasmer run target/wasm32-wasi/debug/cve-rs.wasmcve-rs to your Rust project as a dependency using Cargo, or install the example binary directly to your system.cve-rs provides safe implementations of the following vulnerabilities:
It also includes safe versions of:
std::mem::transmutestd::ptr::null() / null_mut() (but for references)segfault() function is designed to intentionally cause a segmentation fault in the running program. It achieves this by creating a mutable null reference and attempting to dereference it. If the initial null dereference fails to trigger a fault, it attempts to dereference a non-allocating reference (using crate::not_alloc::<u8>()), which is noted to be effective on WASM platforms. This function returns the never type !, meaning it will not return control to the caller.transmute function provides a memory-safe implementation of std::mem::transmute. It allows you to interpret a value of type A as a value of type B. This is useful for bit-level reinterpretation of data without using unsafe blocks.The download_more_ram function attempts to fetch a slice of memory from a remote API and transmute it into a mutable slice of type &'a mut [T]. This function is only available when the download-more-ram feature is enabled.
Warning: This function is highly unstable and relies on external network calls to simulate memory acquisition.
The step_on_lego function triggers memory corruption by creating a random reference to an arbitrary memory location. This function is only available when the give-up or step-on-lego features are enabled.
Warning: This function is intentionally dangerous and designed to cause instability or crashes.
The give_up function creates a Box<T> containing random bytes. This is useful for simulating memory corruption or uninitialized data. This function is only available when the give-up or step-on-lego features are enabled.
Warning: This function is intentionally dangerous.
Use construct_fake_string to create a String from a raw pointer, capacity, and length. While the function itself is designed to be memory-safe via internal transmutes, you must manage the lifecycle of the resulting String manually to avoid allocator errors.
Safety Note: You must use std::mem::forget on the returned String to prevent Rust from attempting to deallocate the pointer using the global allocator, which would result in undefined behavior since the pointer was not originally allocated by that allocator.
The library exports several modules and functions that implement specific types of memory vulnerabilities. These are the primary entry points for simulating CVE-like behavior:
buffer_overflow::buffer_overflow: Simulates buffer overflows.segfault::segfault: Simulates segmentation faults.transmute::transmute: Provides low-level type transmutation.use_after_free::use_after_free: Simulates use-after-free vulnerabilities.references::null: Provides null pointer references.references::null_mut: Provides null mutable pointer references.references::not_alloc: Provides non-allocated references.cve-rs CLI: