Technology Secure by Design: Google’s Perspective on Memory Safety

[vtqhtr413]

Content source

https://security.googleblog.com/2024/03/secure-by-design-googles-perspective-on.html

Google’s Project Zero reports that memory safety vulnerabilities—security defects caused by subtle coding errors related to how a program accesses memory—have been "the standard for attacking software for the last few decades and it’s still how attackers are having success". Their analysis shows two thirds of 0-day exploits detected in the wild used memory corruption vulnerabilities. Despite substantial investments to improve memory-unsafe languages, those vulnerabilities continue to top the most commonly exploited vulnerability classes.

This paper delves into the data, challenges of tackling memory unsafety, and discusses possible approaches for achieving memory safety and their tradeoffs. We'll also highlight our commitments towards implementing several of the solutions outlined in the whitepaper, most recently with a $1,000,000 grant to the Rust Foundation, thereby advancing the development of a robust memory-safe ecosystem.

Secure by Design: Google’s Perspective on Memory Safety

Alex Rebert, Software Engineer, Christoph Kern, Principal Engineer, Security Foundations Google’s Project Zero reports that memory safety v...

security.googleblog.com

 

[Bot]

Google's Project Zero highlights the persistent issue of memory safety vulnerabilities, which have been a standard method of software attack for years. Despite efforts to improve memory-unsafe languages, these vulnerabilities remain prevalent. Google is committed to addressing this issue, as shown by their $1,000,000 grant to the Rust Foundation to aid in the development of a robust memory-safe ecosystem.

 

[LennyFox]

• Google recently announced a $1,000,000 grant to the Rust foundation to enhance interoperability with C++ code. This will facilitate incremental adoption of Rust in existing memory-unsafe code bases, which will be key to enabling even more new development to occur in a memory-safe language. Relatedly, we are also working on addressing cross-language attacks that can occur when mixing Rust and C++ in the same binary.

Interoperability wil increase the ease of transition gigantically, allowing smaller incremental steps of replacing C++ by Rust. In stead of converting large chunks of code which leave the system in a consistent state after completing, interoperability allows for smaller pieces of code with autonomous functions. Because of multi-threading and parallelization of tasks this makes the conversion a lot easier to plan en perform.

In layman terms, you can compare this with Formula1 car tire change. Without interoperability a large chunk of code has to be replaced compared with F1-car stopping with old tires and starting again with new tires (you need all the four tires to be able to drive again, so a car with three wheels replaced is not in a consistent state). With interoperability you can replace chunks of code related to the mechanics working at the tire change all at the same time, e.g. first replace the C++ code with Rust for the man holding the stop/go sign (that is an autonomous task), than the mechanic at the front lifting the car with a jack, than the guy unbolting and bolting the wheels, then the guy taking of the old tire, etc. Interoperability allows the mechanic which (un)bolts the tire in Rust can work together with the two mechanics taking of and putting on the new tire who are still working in C++

Brave already has put chunks of code (e.g. the build-in adblocker) in Rust. Firefox was the first (both as innovator and driving force) to change C++ to Rust (link), but they had to cut resources (link) because of losing users (Edge taking over Firefox as number two browser). It now seems that Google has stepped in. It must feel to Firefox as a Tapir being slowly strangled by the Anaconda Google. Google might also counteract Brave and Firefox (as possible alternatives after implementing Mv3) by (one) allowing more functionality in Mv3 for adblockers and (two) jumping on the Rust train to memory integrity.

Apologize for being a bit skeptical on Google's motives, I am surely applauding their donation to the Rust foundation