Building Sound Evaluation Practices for Rust-Based Security Frameworks
Researchers propose a reproducible way to evaluate Rust fuzzers and test it on 20 projects.
An arXiv cs.CR paper says Rust programs, including the standard library, still contain memory-safety vulnerabilities and that evaluations of Rust security tools need a more reproducible methodology. The authors propose unsafe-code coverage oracles that require no forward porting and metrics for test-set diversity. They apply the method to popular Rust fuzzers using 20 Rust projects. The excerpt does not disclose a specific new vulnerability.
- Paper proposes sounder evaluations for Rust security tools.
- Oracles measure unsafe-code coverage without forward porting.
- Authors test popular Rust fuzzers on 20 projects.
- Work responds to known flaws in C and C++ tool studies.
From the original article
1 min read at arxiv.orgBackground: Rust is a modern programming language known for its focus on usability, concurrency, and security. However, empirical studies reveal that Rust is still affected by software vulnerabilities, with hundreds of memory safety issues found in Rust programs, including Rust's standard library. As a result, additional tool-assisted security testing is crucial to enhance the security of Rust code.
By David Paaßen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.