Double Free in Axum with Mutual Tls

A Double Free occurs when a program attempts to free the same dynamically allocated memory twice. In the context of an Axum web service using Mutual Transport Layer Security (Mutual TLS), the interaction between request handling, TLS session management, and Rust’s ownership model can inadvertently create conditions where memory is freed more than once. Axum is a Rust web framework, and while Rust’s safety guarantees typically prevent memory safety issues, improper use of unsafe blocks, raw pointers, or integration with native TLS libraries can reintroduce such risks.

When Mutual TLS is enabled, the server performs client certificate verification during the TLS handshake. This process involves allocating cryptographic buffers for certificates, keys, and handshake state. If the application or its dependencies improperly manage these buffers—such as releasing them in a request guard and again in a drop implementation for a shared state object—a Double Free can occur. This is particularly risky when developers store TLS-related structures in Arc<Mutex<...>> or similar shared containers and then manually manage memory in unsafe contexts.

For example, consider a scenario where a developer uses the rustls crate with Axum and stores a rustls::ServerConfig inside an Arc. If the configuration includes custom certificate verifiers that allocate intermediate buffers, and those buffers are also referenced in a request-scoped cleanup routine, the same memory may be freed when the request ends and again when the ServerConfig is dropped. This pattern can manifest as a Double Free when the TLS handshake completes and the request guard is dropped, triggering deallocation of associated cryptographic material.

Double Free vulnerabilities in this context can lead to undefined behavior, including crashes, memory corruption, or potential code execution. While Axum does not directly expose TLS internals, the combination of asynchronous request handling and low-level TLS integration increases the surface area for such issues if unsafe code is used. Security scanners like middleBrick detect patterns that may indicate unsafe memory practices, especially when Mutual TLS is involved, by analyzing dependencies and flagging risky integrations with native libraries.

middleBrick’s LLM/AI Security checks are particularly relevant here, as they can identify prompt patterns that suggest insecure memory handling in AI-assisted code generation. For instance, if a developer uses an AI to generate TLS setup code without understanding Rust’s ownership rules, the output may inadvertently introduce Double Free risks. middleBrick scans for such insecure implementations and provides findings aligned with OWASP API Top 10 and CWE-415 (Double Free).

To prevent Double Free issues when using Mutual TLS in Axum, follow these concrete remediation steps with properly structured code examples.

1. Use Safe Rust Constructs and Avoid Manual Memory Management

Rely on Rust’s ownership and borrowing system. Store TLS configurations in Arc and avoid raw pointers or unsafe blocks unless absolutely necessary. Prefer high-level TLS libraries like axum-extra or rustls with managed state.

use std::sync::Arc;
use axum::Router;
use rustls::{ServerConfig, Certificate, PrivateKey};
use rustls_pemfile::{certs, pkcs8_private_keys};
use std::fs::File;
use std::io::BufReader;

async fn create_axum_server() -> Router {
    // Load server certificate and key safely
    let cert_file = &mut BufReader::new(File::open("cert.pem").expect("cannot open cert.pem"));
    let key_file = &mut BufReader::new(File::open("key.pem").expect("cannot open key.pem"));

    let cert_chain: Vec<Certificate> = certs(cert_file).unwrap().into_iter().map(Certificate).collect();
    let mut keys: Vec<PrivateKey> = pkcs8_private_keys(key_file).unwrap().into_iter().map(PrivateKey).collect();

    let config = ServerConfig::builder()
        .with_safe_defaults()
        .with_no_client_auth() // For demonstration; use with_client_auth for Mutual TLS
        .with_single_cert(cert_chain, keys.remove(0))
        .expect("invalid certificate or key");

    let shared_config = Arc::new(config);

    // Build Axum router with shared config
    Router::new()
        .layer(axum::Extension(shared_config))
        .route("/", axum::routing::get(|| async { "Hello" }))
}

2. Implement Proper Client Certificate Verification

For Mutual TLS, use rustls’s with_client_auth and ensure client certificates are validated without duplicating buffer lifetimes.

use rustls::{ClientAuth, RootCertStore};
use std::sync::Arc;

fn configure_mutual_tls() -> ServerConfig {
    let mut client_root_store = RootCertStore::empty();
    // Load trusted client CA certificates
    client_root_store.add(&Certificate(vec![/* CA cert bytes */])).unwrap();

    ServerConfig::builder()
        .with_safe_defaults()
        .with_client_auth(ClientAuth::Required { 
            client_root_store,
            // Optional: provide verify_client_cert
            verify_client_cert: None, 
        })
        .with_single_cert(
            vec![Certificate(vec![/* server cert */])],
            PrivateKey(vec![/* server key */]),
        )
        .expect("Failed to build TLS config")
}

3. Avoid Double Drops with Custom State Management

If using shared state, ensure that any TLS-related buffers are not freed multiple times. Use Arc::try_unwrap carefully and avoid implementing Drop for types that contain raw pointers to TLS-managed memory.

use std::sync::{Arc, Mutex};

struct ApiState {
    tls_metadata: Vec<u8>, // Example buffer, not raw pointer
}

// Safe usage: Arc ensures single ownership until last reference is dropped
let state = Arc::new(Mutex::new(ApiState {
    tls_metadata: vec![0; 1024],
}));

// Clone Arc for shared use — no manual free needed
let state_clone = Arc::clone(&state);
// When last Arc is dropped, memory is freed exactly once

middleBrick’s CLI tool can be used to scan your Axum endpoints and detect potential memory safety patterns when Mutual TLS is enabled. Run middlebrick scan <your-api-url> to receive a security risk score and findings. For teams, the Pro plan enables continuous monitoring and CI/CD integration to catch such issues before deployment.

Additionally, the MCP Server allows AI coding assistants to trigger scans directly, helping developers identify unsafe patterns during implementation. This is especially useful for preventing issues like Double Free in complex TLS configurations.