#memory-safety #safety #security #cve #memory-block #soundness #segfault

bin+lib cve-rs

Blazingly fast memory vulnerabilities, written in 100% safe Rust

6 releases (breaking)

0.6.0 Feb 21, 2024
0.5.0 Feb 20, 2024
0.4.0 Feb 20, 2024
0.3.0 Feb 17, 2024
0.1.0 Feb 16, 2024

#473 in Rust patterns

Custom license

330 lines

Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀

cve-rs allows you to introduce common memory vulnerabilities (such as buffer overflows and segfaults) into your Rust program in a memory safe manner.

Rust is an amazing language. You can program a lot of useful things while ensuring that your program will stay safe. Unfortunately, safe Rust is quite limiting. For example, you cannot introduce code that could corrupt the program's memory. Now, with cve-rs, you can corrupt your program's memory without corrupting your program's memory.

We are very committed to making sure cve-rs is memory-safe. We know that unsafe code can have unintended consequences, such as memory unsafety that causes programs to be insecure or unstable.

That is why cve-rs uses #![deny(unsafe_code)] in the entire codebase. There is not a single block of unsafe code* in this project.

* There is, unfortunately, one exception: In our tests, we compare the results of our safe transmute function against the regular std::mem::transmute function. Perhaps somewhat shortsightedly, the standard library implementation is unsafe. Regardless, this is only in our tests - the core library has no unsafe code.

cve-rs implements the following bugs in safe Rust:

  • Use after free
  • Buffer overflow
  • Segmentation fault

cve-rs also contains safe reimplementations of:

  • std::mem::transmute
  • std::ptr::null()/null_mut() but for references

Here is an example of usage with the segfault subcommand:

segfault demo


cve-rs can be used directly with Cargo.

To use it as a library:

cargo add cve-rs

Or to run our example binary:

cargo install cve-rs

WASM support

cve-rs supports WASM through the WASI API.

You can compile it and run it using Wasmer with the following commands:

cargo build --target wasm32-wasi
wasmer run target/wasm32-wasi/debug/cve-rs.wasm


Special thanks to @Bright-Shard and @Creative0708!

Can I use cve-rs in production?

This project is licensed under the GLWTSPL.


This project is licensed under the GLWTSPL.

Good Luck