Use After Free in Axum

Use After Free (UAF) vulnerabilities in Axum applications typically occur when resources are dropped or deallocated while still being referenced by the application, leading to undefined behavior or security issues. In Axum's async context, these vulnerabilities often manifest in connection pooling, request handling, and state management scenarios.

use axum::{routing::get, Router};
use std::sync::Arc;
use tokio::sync::Mutex;

struct AppState {
    user_data: Vec<User>,
    is_active: bool,
}

async fn get_user(
    state: Arc<Mutex<AppState>>,
    user_id: String,
) -> String {
    let state = state.lock().await;
    let user = state.user_data.iter().find(|u| u.id == user_id);
    
    // Potential UAF: state is dropped here, but we're about to use it
    if state.is_active {
        // This access is unsafe if state was dropped
        return user.unwrap().name.clone();
    }
    
    "User not found".to_string()
}

let app = Router::new().route(
    "/user/:id",
    get(get_user),
);

The above example demonstrates a classic UAF pattern where the locked state is accessed after the lock guard may have been dropped. In Axum's async handlers, this can lead to data races when multiple requests access shared state concurrently.

Another common pattern involves improper handling of request bodies and streaming responses:

async fn stream_response(req: axum::extract::Request) -> impl axum::response::IntoResponse {
    let (parts, body) = req.into_parts();
    let body_bytes = hyper::body::to_bytes(body).await.unwrap();
    
    // The body is now consumed, but we're holding onto parts
    // that may reference deallocated memory
    let headers = parts.headers;
    
    // This can cause use-after-free if headers reference dropped data
    if headers.contains("X-Special-Header") {
        return axum::response::Response::builder()
            .header("Content-Type", "application/json")
            .body(body_bytes)
            .unwrap();
    }
    
    axum::response::Response::new(body_bytes)
}

Connection pooling in Axum applications can also introduce UAF vulnerabilities when connections are reused without proper synchronization:

use axum::extract::connect_info::ConnectInfo;
use sqlx::postgres::PgPool;

async fn query_db(
    ConnectInfo(pool): ConnectInfo<PgPool>,
    user_id: String,
) -> String {
    // The pool connection might be dropped by another task
    // while we're still using it
    let result = sqlx::query("SELECT name FROM users WHERE id = $1")
        .bind(user_id)
        .fetch_one(&pool)
        .await;
    
    // Potential UAF if the connection was closed concurrently
    result.unwrap().get(0).to_string()
}

Detecting Use After Free vulnerabilities in Axum applications requires a combination of static analysis and runtime monitoring. The async nature of Axum makes traditional UAF detection more challenging, as lifetimes and borrowing rules become more complex.

middleBrick's security scanning specifically targets Axum applications by analyzing the runtime behavior of async handlers and state management patterns. The scanner examines how shared state is accessed across concurrent requests and identifies potential race conditions.

// middleBrick scan output for Axum UAF detection
{
  "endpoint": "/api/user/profile",
  "risk_score": 72,
  "category": "Race Condition / Use After Free",
  "severity": "High",
  "finding": "Shared state accessed without proper synchronization",
  "remediation": "Use Arc<Mutex<_>> or RwLock for concurrent access",
  "code_snippet": "...",
  "line_number": 42
}

The scanner specifically looks for patterns like:

• Unprotected access to Arc<Mutex<_>> or Arc<RwLock<_>> shared state
• Request body consumption without proper error handling
• Connection pooling without connection lifecycle management
• Async handler patterns that capture references beyond their intended scope

For manual detection, developers should use Rust's built-in tools:

// Use clippy to detect potential UAF patterns
cargo clippy -- -D warnings

// Enable runtime checks for data races
RUSTFLAGS="-Z sanitizer=thread" cargo run

// Use Miri for undefined behavior detection
cargo miri test

middleBrick's API security scanner goes beyond static analysis by actively testing the running application. It sends concurrent requests to the same endpoint to trigger race conditions and monitors for crashes, panics, or inconsistent responses that indicate UAF vulnerabilities.

The scanner also analyzes OpenAPI specifications for Axum applications to identify endpoints that handle shared mutable state, then correlates this with runtime behavior to prioritize the most critical findings.

Remediating Use After Free vulnerabilities in Axum requires understanding Rust's ownership model and applying proper synchronization patterns. The key is ensuring that resources remain valid for the entire duration of their use, especially in async contexts.

For shared state access, use proper synchronization primitives:

use axum::{routing::get, Router};
use std::sync::Arc;
use tokio::sync::RwLock;

struct AppState {
    users: Vec<User>,
    config: Config,
}

async fn get_user(
    state: Arc<RwLock<AppState>>,
    user_id: String,
) -> String {
    // Use read lock for concurrent reads
    let state = state.read().await;
    let user = state.users.iter().find(|u| u.id == user_id);
    
    if let Some(user) = user {
        // Safe: read lock keeps state alive
        return user.name.clone();
    }
    
    "User not found".to_string()
}

async fn update_user(
    state: Arc<RwLock<AppState>>,
    user_id: String,
    new_name: String,
) -> String {
    // Use write lock for exclusive access
    let mut state = state.write().await;
    let user = state.users.iter_mut().find(|u| u.id == user_id);
    
    if let Some(user) = user {
        user.name = new_name;
        return "Updated successfully".to_string();
    }
    
    "User not found".to_string()
}

For request body handling, ensure proper consumption and error handling:

use axum::{extract::Request, response::Response};
use hyper::body::Bytes;

async fn safe_stream_response(
    req: Request,
) -> Response {
    // Consume body safely with proper error handling
    let body_bytes = match hyper::body::to_bytes(req.into_body()).await {
        Ok(bytes) => bytes,
        Err(e) => {
            return axum::response::Response::builder()
                .status(400)
                .body(format!("Body read error: {}", e))
                .unwrap();
        }
    };
    
    // Process body safely
    let headers = req.headers();
    let content_type = headers.get("content-type");
    
    // No UAF: we're not holding onto any references that could be dropped
    if content_type == Some(&"application/json") {
        return axum::response::Response::builder()
            .header("Content-Type", "application/json")
            .body(body_bytes)
            .unwrap();
    }
    
    axum::response::Response::new(body_bytes)
}

For connection pooling, use connection lifecycle management:

use axum::extract::connect_info::ConnectInfo;
use sqlx::postgres::PgPool;

async fn safe_query_db(
    ConnectInfo(pool): ConnectInfo<PgPool>,
    user_id: String,
) -> String {
    // Clone the pool for each operation to ensure proper lifecycle
    let pool = pool.clone();
    
    let result = sqlx::query("SELECT name FROM users WHERE id = $1")
        .bind(user_id)
        .fetch_one(&pool)
        .await;
    
    match result {
        Ok(row) => row.get(0).to_string(),
        Err(e) => format!("Query error: {}", e),
    }
}

middleBrick's CLI tool can verify these fixes:

# Scan your Axum application after remediation
middlebrick scan http://localhost:3000/api

# Check for specific UAF patterns
middlebrick scan --category "Race Condition" http://localhost:3000/api

# Integrate into your CI/CD pipeline
middlebrick scan --fail-threshold 80 http://staging-api.example.com