Search papers, labs, and topics across Lattice.
This paper introduces RustGo, a Rust-directed greybox fuzzer that enhances the efficiency of fuzz testing by focusing specifically on regions of code likely to contain memory bugs. By employing Rust-specific static analysis, RustGo prunes irrelevant paths, achieving an average reduction of 78.49% in unnecessary fuzzing efforts while accelerating target reach by 2.09 to 5.08 times compared to existing methods. The approach not only improves resource utilization but also uncovers 13 previously unknown bugs, demonstrating its practical impact on Rust memory safety.
RustGo prunes 78.49% of irrelevant paths, accelerating bug discovery in unsafe Rust code while uncovering 13 previously unknown vulnerabilities.
Rust is a popular systems programming language that provides strong memory safety and introduces low-performance overhead. While Rust guarantees memory safety through strict security policies, such as ownership, memory bugs can still occur in unsafe-related Rust codes where these policies are not fully enforced. Although such unsafe Rust code accounts for only a small portion of the entire code (e.g., 10%), existing approaches fuzz the entire code-including safe Rust, whose memory safety is already enforced by the Rust compiler-resulting in inefficient use of fuzzing resources. In this paper, we propose RustGo, the new Rust-directed greybox fuzzer that effectively and fairly focuses on code regions potentially containing memory bugs. For this, RustGo automatically identifies potential memory bug targets and accurately prunes the paths irrelevant to each target by leveraging Rust-specific static analysis. For each identified target, RustGo includes a new fuzzing approach that maintains an independent state and applies dynamic pruning to maximize balanced and focused fuzzing. We evaluate RustGo on various real-world Rust applications. On average, RustGo prunes 78.49% of irrelevant paths, reaches targets x 2.09 to x 5.08 faster than existing fuzzers, and identifies 13 unknown bugs (six assigned RUSTSEC IDs and one assigned CVE ID).
