rust-security

name

rust-security

description

Use when auditing Rust dependencies with cargo-audit, configuring cargo-deny policies, triaging RUSTSEC advisories, evaluating a new crate for typosquat/supply-chain risk before adding it to Cargo.toml, responding to a published CVE on a pinned dep, or modifying native/rust/deny.toml. Triggers on "cargo audit", "cargo deny --locked", "RUSTSEC", "advisory", "supply chain", or new-dependency-addition reviews.

Rust Supply Chain Security

Purpose

Guide agents through Rust supply chain security: vulnerability scanning with cargo-audit, policy enforcement with cargo-deny (as configured in this project), and RUSTSEC advisory triage. For FFI safety, fuzzing, sanitizers, and Miri, see cross-references at the end.

Triggers

• "How do I check my Rust dependencies for CVEs?"
• "How do I use cargo-audit / cargo-deny?"
• "How do I enforce dependency policies in CI?"
• "What's the RUSTSEC advisory database?"
• "A dependency has a security advisory -- what do I do?"

Project context

• 97 Rust crates under native/rust/
• Policy config: native/rust/deny.toml
• CI job: cargo-deny in .github/workflows/ci.yml (cargo-deny v0.19.0, installed via taiki-e/install-action@v2)
• CI invocation: cargo deny --locked --manifest-path native/rust/Cargo.toml check

Workflow

1. cargo-audit -- vulnerability scanning

# Install
cargo install cargo-audit --locked

# Scan current project
cargo audit

# Strict mode: treat warnings as errors (good for CI)
cargo audit --deny warnings

# Audit a specific lockfile
cargo audit --file native/rust/Cargo.lock

# JSON output for scripting
cargo audit --json | jq '.vulnerabilities.list[].advisory.id'

Output format:

error[RUSTSEC-2023-0052]: Vulnerability in `vm-superio`
    Severity: low
       Title: MMIO Register Misuse
    Solution: upgrade to `>= 0.7.0`

2. cargo-deny -- policy enforcement

cargo-deny goes beyond audit: it enforces license policies, bans specific crates, checks source origins, and validates duplicate dependency versions.

# Run all checks against project config
cargo deny --locked --manifest-path native/rust/Cargo.toml check

# Run a specific check
cargo deny --locked --manifest-path native/rust/Cargo.toml check advisories
cargo deny --locked --manifest-path native/rust/Cargo.toml check licenses
cargo deny --locked --manifest-path native/rust/Cargo.toml check bans
cargo deny --locked --manifest-path native/rust/Cargo.toml check sources

Project deny.toml (native/rust/deny.toml)

The project config enforces:

• advisories: vulnerabilities denied by default; current ignore list has one entry — RUSTSEC-2024-0436 (paste 1.0.15 proc-macro, unmaintained, pulled transitively via netlink-packet-core; no upstream replacement available as of this writing). Any new ignore entry requires a tracking issue and an SLA for re-evaluation (see "RUSTSEC triage SLA" below).
• licenses: allowlist of permissive licenses (MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, Zlib, CDLA-Permissive-2.0, Unicode-3.0, OpenSSL); confidence threshold 0.8
• bans: multiple-versions = "warn", wildcards = "warn", highlight = "all"
• sources: unknown-registry = "deny", unknown-git = "warn", only crates.io allowed via allow-registry

When modifying deny.toml, always run cargo deny --locked --manifest-path native/rust/Cargo.toml check locally before pushing to validate changes.

3. RUSTSEC advisory database

The RUSTSEC database at https://rustsec.org/ tracks vulnerabilities, unmaintained crates, and unsound code.

# Sync and browse local advisory DB
cargo audit fetch
ls ~/.cargo/advisory-db/crates/

# View a specific advisory on the web
# https://rustsec.org/advisories/RUSTSEC-2023-0001.html

# Advisory categories:
# vulnerability -- exploitable security bug
# unmaintained -- no longer maintained (supply chain risk)
# unsound     -- documented unsoundness in safe API
# yanked      -- crate version yanked from crates.io

3a. Supply-chain incidents to learn from (2025)

Three confirmed malicious-crate incidents hit crates.io in RIPDPI's exact dependency namespace in the second half of 2025. Read them before dismissing a new dep addition as low-risk:

• September 2025 — faster_log and async_println (typosquat of popular async-logging names). Payload exfiltrated CI tokens and SSH keys. See https://blog.rust-lang.org/2025/09/24/crates.io-malicious-crates-fasterlog-and-asyncprintln/.
• December 2025 — finch-rust and sha-rust (typosquat of crypto/hash utilities). Same attack class. See https://blog.rust-lang.org/2025/12/05/crates.io-malicious-crates-finch-rust-and-sha-rust.

Attack class: typosquatting against async and crypto utility names — the exact dependency category RIPDPI pulls from. Every new crate addition to Cargo.toml must:

1. Verify the crate name against the intended upstream (typo check).
2. Run cargo deny --locked check bans advisories sources locally before the first cargo update.
3. Scan the published crate's build.rs / src/lib.rs for network calls, shell-out, or process spawns. A utility crate that opens sockets is a red flag.
4. Pin to a specific version (=1.2.3) for the first adoption commit; loosen to ^1.2 only after the crate has been in the tree for at least one release cycle without incident.

cargo-deny 0.19.0 (Jan 2026, the version pinned in CI) improved bans and sources rule expressiveness — use allow = [...] / deny = [...] lists rather than relying solely on multiple-versions detection.

3b. RUSTSEC triage SLA

Any advisory ID added to deny.toml's [advisories].ignore list is a time-boxed commitment, not a permanent exemption:

Severity	SLA before the ignore becomes blocking
Low / informational (unmaintained, no runtime exploit)	90 days
Medium (exploit requires specific conditions not met in RIPDPI)	30 days
High / Critical	7 days — no ignore should exist; patch or pin

Each ignore entry MUST include:

• id — the RUSTSEC ID
• reason — one sentence explaining why it's safe to ignore in this project
• A tracking issue link in a trailing comment

The RUSTSEC-2024-0436 entry meets the bar because paste is a proc-macro (compile-time only, no runtime code path) and there is no published fix. When a fix ships, remove the entry in the same PR that upgrades netlink-packet-core.

4. Responding to a new advisory

# 1. Identify affected crate and version
cargo audit 2>&1 | grep -A3 'RUSTSEC-'

# 2. Check if an upgrade is available
cargo update -p <crate_name> --dry-run

# 3. If upgrade exists, apply it
cargo update -p <crate_name>

# 4. If no fix yet, assess and optionally add to deny.toml ignore list
#    Only add with a comment explaining why and a tracking issue
#    Example in deny.toml:
#    ignore = [
#        { id = "RUSTSEC-2024-XXXX", reason = "not reachable in our code path, tracking #123" },
#    ]

# 5. Verify
cargo deny --locked --manifest-path native/rust/Cargo.toml check advisories

5. Supply chain hardening

# Always commit Cargo.lock for applications/binaries
# Use --locked in CI to enforce lockfile matches
cargo fetch --locked

# Audit full dependency tree
cargo tree --locked                  # view full tree
cargo tree --locked -d               # show duplicate versions

# Find unused dependencies
cargo machete

# Vet dependencies with cargo-vet (peer review)
cargo install cargo-vet
cargo vet

6. CI integration

The project CI runs cargo-deny as a standalone job on every PR (skipped for scheduled builds). The job:

1. Checks out the repo
2. Installs cargo-deny v0.19.0 via taiki-e/install-action@v2
3. Runs cargo deny --locked --manifest-path native/rust/Cargo.toml check

If the CI job fails:

• Check the failing check category (advisories, licenses, bans, sources)
• Run the same command locally to reproduce
• Fix the root cause; do not extend ignore lists without a tracking issue

Related skills

• .claude/skills/rust-sanitizers-miri -- Miri and sanitizer usage for memory safety validation
• .claude/skills/rust-unsafe -- unsafe code audit patterns and safe abstraction design
• .github/skills/rust-jni-bridge -- JNI FFI patterns (the project's FFI boundary)
• .claude/skills/cargo-workflows -- Cargo.lock management, workspaces, and feature flags