Memory-Safety Challenge Considered Solved? An In-Depth Study with All Rust CVEs
release_houx2ikpubcnhati3huggalxle
by
Hui Xu, Zhuangbin Chen, Mingshen Sun, Yangfan Zhou, Michael Lyu
2021
Abstract
Rust is an emerging programing language that aims at preventing memory-safety
bugs without sacrificing much efficiency. The claimed property is very
attractive to developers, and many projects start using the language. However,
can Rust achieve the memory-safety promise? This paper studies the question by
surveying 186 real-world bug reports collected from several origins which
contain all existing Rust CVEs (common vulnerability and exposures) of
memory-safety issues by 2020-12-31. We manually analyze each bug and extract
their culprit patterns. Our analysis result shows that Rust can keep its
promise that all memory-safety bugs require unsafe code, and many memory-safety
bugs in our dataset are mild soundness issues that only leave a possibility to
write memory-safety bugs without unsafe code. Furthermore, we summarize three
typical categories of memory-safety bugs, including automatic memory reclaim,
unsound function, and unsound generic or trait. While automatic memory claim
bugs are related to the side effect of Rust newly-adopted ownership-based
resource management scheme, unsound function reveals the essential challenge of
Rust development for avoiding unsound code, and unsound generic or trait
intensifies the risk of introducing unsoundness. Based on these findings, we
propose two promising directions towards improving the security of Rust
development, including several best practices of using specific APIs and
methods to detect particular bugs involving unsafe code. Our work intends to
raise more discussions regarding the memory-safety issues of Rust and
facilitate the maturity of the language.
In text/plain
format
Archived Content
There are no accessible files associated with this release. You could check other releases for this work for an accessible version.
Know of a fulltext copy of on the public web? Submit a URL and we will archive it
2003.03296v6
access all versions, variants, and formats of this works (eg, pre-prints)