CISA Report Reveals Memory Safety Risks in Critical Open Source Projects: Over 50% Use Vulnerable Code

 

CISA Report Reveals Memory Safety Risks in Critical Open Source Projects: Over 50% Use Vulnerable Code

The US government's Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI, the Australian Signals Directorate’s Australian Cyber Security Center, and the Canadian Cyber Security Center, issued a report titled "Exploring Memory Safety in Critical Open Source Projects." The report found that more than half of 172 critical open source projects contain code written in memory-unsafe languages like C and C++, which are prone to memory safety vulnerabilities.

Memory safety errors such as buffer overflows, use of uninitialized memory, type confusion, and use-after-free flaws are common in C/C++ code and account for the majority of vulnerabilities in large codebases. The report encourages public and private sector organizations to reduce software vulnerabilities arising from these memory safety bugs.

Despite the presence of memory-safe languages such as C#, Go, Java, Python, Rust, and Swift, which handle memory management for developers, some projects still face memory vulnerabilities through unsafe dependencies. Memory-unsafe languages require developers to manage memory use and allocation properly, and mistakes can result in vulnerabilities that allow adversaries to control software, systems, and data.

In December 2023, CISA, with help from the NSA, FBI, and the cybersecurity authorities of Australia, Canada, the UK, and New Zealand, published a paper titled "The Case for Memory Safety Roadmaps," which aligns with America's 2023 National Cybersecurity Strategy. This initiative emphasizes the importance of addressing memory safety to improve software security.

Image credit: The Canton Group 

The report analyzed 172 critical projects compiled by the Open Source Security Foundation and found that 52 percent of the projects contain code written in memory-unsafe languages. Additionally, 55 percent of the total lines of code (LoC) were written in such languages, with the largest projects disproportionately relying on them. For instance, the Linux kernel predominantly uses memory-unsafe languages, and other large projects like Chromium and Gecko use these languages for roughly half of their code.

Efforts are underway to rewrite critical open source libraries in memory-safe languages like Rust. The Rust Foundation, backed by AWS, Huawei, Google, Microsoft, and Mozilla, has been promoting Rust, which offers strong memory-safety guarantees. However, transitioning from C/C++ to Rust or other memory-safe languages is a gradual process.

Microsoft and Google have been moving towards memory-safe languages for new projects and application rewrites. For example, Google reported that its Rust development teams are twice as productive as its C++ teams. Additionally, the Prossimo project is rewriting critical open source libraries in Rust to reduce the risk of memory flaws in legacy code.

Despite the progress, CISA's report concludes by urging further efforts to expand the understanding of memory-unsafety risks in open source software and to consider targeted rewrites of critical components in memory-safe languages. Gunnar Braun, technical manager at the Synopsys Software Integrity Group, emphasized the importance of memory safety in making software more secure and advocated for the use of static code analysis and fuzzing tools to mitigate memory-safety risks in projects where changing programming languages is not feasible.