Discussion: Function-level reachability of vulnerabilities

I’ve been working on a research prototype around Rust vulnerability reachability, and I recently turned part of it into a tool. This tool complements cargo-audit by checking, at the function call level, whether vulnerabilities could actually affect the crate being analyzed. The analysis is based on MIR. As a prototype, there may be some inaccuracies, but I’ve included as many calling patterns as possible. This does not perform a precise pointer analysis; instead, it tends to flag all suspicious call chains. An example is v_frame of version 0.3.2, which depends on maligned 0.2.1.

cargo audit reports:

Crate:     maligned
Version:   0.2.1
Warning:   unsound
Title:     `maligned::align_first` causes incorrect deallocation
ID:        RUSTSEC-2023-0017
Dependency tree:
maligned 0.2.1
└── v_frame 0.3.2

The tool reports:

Found 1 advisories:

✗ VULNERABLE RUSTSEC-2023-0017
  Package: maligned 0.2.1
  Title: `maligned::align_first` causes incorrect deallocation
  URL: https://github.com/tylerhawkes/maligned/issues/5
  Affected functions:
    - maligned::align_first
    - maligned::align_first_boxed
    - maligned::align_first_boxed_cloned
    - maligned::align_first_boxed_default
  Call chains:
    → frame::Frame::<T>::new_with_padding -> plane::Plane::<T>::new -> plane::PlaneData::<T>::new -> maligned::align_first_boxed_cloned::<T, maligned::A64> -> maligned::align_first_boxed::<T, maligned::A64, {closure@maligned::align_first_boxed_cloned<T, maligned::A64>::{closure#0}}> -> maligned::align_first::<T, maligned::A64>
    → plane::PlaneData::<T>::new -> maligned::align_first_boxed_cloned::<T, maligned::A64> -> maligned::align_first_boxed::<T, maligned::A64, {closure@maligned::align_first_boxed_cloned<T, maligned::A64>::{closure#0}}> -> maligned::align_first::<T, maligned::A64>
    → plane::Plane::<T>::new -> plane::PlaneData::<T>::new -> maligned::align_first_boxed_cloned::<T, maligned::A64> -> maligned::align_first_boxed::<T, maligned::A64, {closure@maligned::align_first_boxed_cloned<T, maligned::A64>::{closure#0}}> -> maligned::align_first::<T, maligned::A64>
 
...(many other call chains)

  Description: `maligned::align_first` manually allocates with an alignment larger than T, and then uses `Vec::from_raw_parts` on that allocation to get a `Vec<T>`.  [`GlobalAlloc::dealloc`](https://doc.rust-lang.org/std/alloc/trait.GlobalAlloc.html#tymethod.dealloc) requires that the `layout` argument must be the same layout that was used to allocate that block of memory....

when no reachable call path is found, it will report No call chains.
Does this tool seem useful to the RustSec ecosystem?

Read the linked rustsec-reachability tool's first-time setup and compare its MIR-based, function-level call-chain output with cargo-audit's advisory behavior. Determine whether a concrete RustSec integration or follow-up is warranted, with a documented decision and scoped next step as the completion criteria.