Evaluating and Improving Static Application Security Testing Tools for Rust
Researchers evaluate Rust SAST tools and use LLM framework TRUST to uncover 46 faults.
The paper evaluates mainstream Rust static application security testing tools against vulnerabilities in real Rust applications and analyzes why they miss bugs. The authors introduce TRUST, an LLM-assisted framework that derives semantics-preserving transformations from the official Rust reference and generates mutant programs to stress-test those tools. TRUST uncovered 46 faults across six popular SAST tools, 17 of which were confirmed, and the study offers ten findings and four lessons for more robust tooling.
- Evaluates mainstream Rust SAST tools on real-world vulnerabilities.
- TRUST derives semantics-preserving transforms from the official Rust reference.
- Found 46 faults across six popular SAST tools; 17 confirmed.
- Reports ten empirical findings and four practical lessons.
From the original article
1 min read at arxiv.orgRust has become a popular systems programming language in recent years because of its strong guarantees on memory and concurrency safety. Many types of system software have been re-implemented in Rust. However, Rust programs can still suffer from common memory and concurrency vulnerabilities due to unsafe code and misunderstandings of its complex mechanisms.
By Huaien Zhang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.