The White House Office of the National Cyber Director (ONCD) urged tech companies today to switch to memory-safe programming languages, such as Rust, to improve software security by reducing the number of memory safety vulnerabilities.
Such vulnerabilities are coding errors or weaknesses within software that can lead to memory management issues when memory can be accessed, written, allocated, or deallocated.
They occur when software accesses memory in unintended or unsafe ways, resulting in various security risks and issues like buffer overflow, use after free, use of uninitialized memory, and double free that attackers can exploit.
Successful exploitation carries severe risks, potentially enabling threat actors to gain unauthorized access to data or execute malicious code with the privileges of the system owner.
“For over 35 years, this same class of vulnerability has vexed the digital ecosystem. The challenge of eliminating entire classes of software vulnerabilities is an urgent and complex problem. Looking forward, new approaches must be taken to mitigate this risk,” ONCD’s report says.
“The highest leverage method to reduce memory safety vulnerabilities is to secure one of the building blocks of cyberspace: the programming language. Using memory safe programming languages can eliminate most memory safety errors.”
Today’s report builds upon the National Cybersecurity Strategy signed by President Biden in March 2023, which shifted the burden of defending the country’s cyberspace towards software vendors and service providers.
The National Security Agency (NSA) also published guidance in November 2022 on how software developers can prevent software memory safety issues.
A similar report from CISA and international partners in December 2023 followed, asking for a transition to memory-safe programming languages to reduce software products’ attack surface by eliminating memory-related vulnerabilities.
As Microsoft discovered years ago, as many as 70 percent of security vulnerabilities identified in software developed using memory-unsafe languages stem from memory safety concerns. This remains true even after thorough code reviews and additional preventive and detection measures, as the company further found.
Yet, findings from Google research show that using a memory-safe language can significantly reduce the number of memory safety flaws even in large code bases and, in some cases, eliminate them altogether.
“For thirty-five years, memory safety vulnerabilities have plagued the digital ecosystem, but it doesn’t have to be this way,” said Anjana Rajan, Assistant National Cyber Director for Technology Security.
“This report was created for engineers by engineers because we know they can make the architecture and design decisions about the building blocks they consume – and this will have a tremendous effect on our ability to reduce the threat surface, protect the digital ecosystem and ultimately, the Nation.”
