Reproduce “RustGo: Fairly Directed Greybox Fuzzing for Enforcing Rust Memory Safety” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Dongyeon Yu, Jiun Min, Yewan Na, Mijung Kim, Taegyu Kim, Yuseok Jeon
RustGo is a directed greybox fuzzer developed for Rust programs, specifically targeting memory safety bugs within `unsafe` code regions. It leverages Rust's intermediate representations (MIR and LLVM IR) for precise vulnerability identification and path pruning, along with a dynamic fair toggling mechanism for multi-target fuzzing. The fuzzer achieved an average speedup of ×3.33 in vulnerability exposure and identified 13 previously unknown memory bugs in real-world Rust applications, leading to RUSTSEC advisories and a CVE.
Key insights
- Vulnerabilities in Rust are primarily concentrated in `unsafe` code regions, requiring specialized fuzzing strategies that efficiently target these areas rather than general program coverage.
- Leveraging Rust's unique compilation artifacts like MIR and LLVM IR, along with customized static analysis, significantly enhances the precision of target identification and path pruning in Rust compared to generic DGFs.
- Achieving balanced and comprehensive fuzzing for multiple targets in a Rust program necessitates dynamic resource allocation and independent state management (e.g., separate input queues and coverage maps) for each target.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.