RustGo：用于强制Rust内存安全的公平定向灰盒模糊测试
RustGo: Fairly Directed Greybox Fuzzing for Enforcing Rust Memory Safety
浏览论文内容
中文总结 AI 辅助
RustGo是针对Rust的定向灰盒模糊器，通过Rust特有静态分析聚焦潜在内存漏洞区域，修剪无关路径，在现实应用中表现优于现有模糊器并识别出13个未知漏洞。
中文摘要 AI 辅助
Rust是一种流行的系统级编程语言，它提供了强大的内存安全保障，且性能开销较低。尽管Rust通过所有权等严格安全策略保证内存安全，但在未完全执行这些策略的与unsafe相关的Rust代码中仍可能出现内存漏洞。虽然这类unsafe Rust代码仅占整个代码的一小部分（例如10%），但现有方法会对整个代码进行模糊测试，包括已由Rust编译器强制执行内存安全的安全Rust代码，导致模糊测试资源利用效率低下。在本文中，我们提出了RustGo，这是一种新型的Rust定向灰盒模糊器，可有效且公平地聚焦于可能包含内存漏洞的代码区域。为此，RustGo利用Rust特有的静态分析自动识别潜在的内存漏洞目标，并准确修剪与每个目标无关的路径。对于每个已识别的目标，RustGo包含一种新的模糊测试方法，该方法维护独立状态并应用动态修剪，以最大化平衡且聚焦的模糊测试。我们在各种现实世界的Rust应用程序上评估了RustGo。平均而言，RustGo修剪了78.49%的无关路径，比现有模糊器到达目标的速度快2.09倍至5.08倍，并识别出13个未知漏洞（其中6个被分配了RUSTSEC ID，1个被分配了CVE ID）。
英文摘要
Rust is a popular systems programming language that provides strong memory safety and introduces low-performance overhead. While Rust guarantees memory safety through strict security policies, such as ownership, memory bugs can still occur in unsafe-related Rust codes where these policies are not fully enforced. Although such unsafe Rust code accounts for only a small portion of the entire code (e.g., 10%), existing approaches fuzz the entire code-including safe Rust, whose memory safety is already enforced by the Rust compiler-resulting in inefficient use of fuzzing resources. In this paper, we propose RustGo, the new Rust-directed greybox fuzzer that effectively and fairly focuses on code regions potentially containing memory bugs. For this, RustGo automatically identifies potential memory bug targets and accurately prunes the paths irrelevant to each target by leveraging Rust-specific static analysis. For each identified target, RustGo includes a new fuzzing approach that maintains an independent state and applies dynamic pruning to maximize balanced and focused fuzzing. We evaluate RustGo on various real-world Rust applications. On average, RustGo prunes 78.49% of irrelevant paths, reaches targets x 2.09 to x 5.08 faster than existing fuzzers, and identifies 13 unknown bugs (six assigned RUSTSEC IDs and one assigned CVE ID).
