2024 61 ERASAN Efficient Rust Address Sanitizer Jiun Min

Summary

In this presentation, Tanu from Unist discusses an innovative approach to improving memory safety in Rust programs through an efficient address sanitizer (Iran). While Rust’s built-in safety features prevent many errors, unsafe Rust code can still lead to memory bugs. The proposed Iran tool focuses on identifying and optimizing low pointer accesses, reducing redundant checks from traditional address sanitizers. By selectively instrumenting only unsafe memory accesses, Iran reduces runtime overhead by 240% while maintaining detection capabilities. The results demonstrate significant performance improvements, making Rust more efficient without sacrificing memory safety.

Takeaways

• 😀 Rust ensures memory safety through ownership, lifetime inference, and bounds checking, which have made it popular in major operating systems like Linux, Android, and Windows.
• 😀 Unsafe Rust allows low-level operations by bypassing memory safety rules, which can lead to memory bugs and vulnerabilities.
• 😀 Over 580 memory bugs have been reported in Rust programs over the last seven years due to unsafe Rust, indicating potential security risks.
• 😀 The existing Address Sanitizer (asan) isn't efficient when applied to Rust because it doesn't account for Rust's memory safety rules, leading to redundant checks and performance overhead.
• 😀 Applying asan directly to Rust results in unnecessary checks on safe memory areas that are already protected by Rust's internal safety mechanisms.
• 😀 Memory bugs in Rust, especially spatial and temporal bugs, are often caused by low pointers and their relationships with other unsafe pointers.
• 😀 Iran, a proposed efficient address sanitizer, reduces redundant checks by focusing only on low pointers and their associated unsafe memory accesses.
• 😀 The Iran approach analyzes memory access sites using a unique Intermediate Representation (IR) to identify unsafe memory accesses related to low pointers.
• 😀 Iran’s selective instrumentation reduces runtime overhead by 240%, compared to the original asan, without compromising bug detection capabilities.
• 😀 Evaluation results show that Iran can remove 90% of unnecessary memory access checks and detect all known CVEs with similar accuracy to traditional asan.
• 😀 Iran optimizes memory access checks by focusing on specific memory access sites, based on object types and pointer relationships, leading to more efficient performance and detection.

Q & A

What is the main problem addressed in this research?

The research addresses the issue of memory safety in Rust programs, specifically focusing on the challenges posed by 'unsafe' Rust code and the potential for memory bugs, such as memory access violations, when strict safety rules are bypassed.

What is 'unsafe' Rust, and why is it important?

'Unsafe' Rust allows developers to write low-level code by bypassing Rust's strict memory safety checks. It is important because it provides flexibility for certain operations but also opens the door to memory bugs and vulnerabilities.

How does the Rust compiler contribute to memory safety?

The Rust compiler enforces strict memory safety through ownership rules, lifetime inference, and bounds checking, which ensures that memory errors are prevented in safe Rust code.

What are the shortcomings of existing sanitizers when applied to Rust?

Existing sanitizers like ASan (AddressSanitizer) are designed without considering Rust's unique memory safety rules. They check memory accesses in all parts of the code, leading to redundant checks and significant performance overhead.

What is the key insight behind the proposed solution, 'Iran'?

The key insight behind Iran is to reduce redundant checks by focusing on memory accesses that occur through 'low pointers'—pointers that bypass Rust's safety rules. By doing so, the overhead of sanitizer checks can be significantly reduced while maintaining detection capabilities.

What are 'low pointers,' and why are they important in this context?

Low pointers are pointers that can reference any memory location without adhering to Rust's safety rules. They are important because they represent the primary source of memory bugs in 'unsafe' Rust code and can trigger both spatial and temporal memory violations.

What types of memory violations does the research focus on?

The research focuses on two types of memory violations: spatial memory violations (e.g., buffer overflows) and temporal memory violations (e.g., use-after-free errors).

How does Iran optimize memory access checks?

Iran optimizes memory access checks by selectively instrumenting only those memory accesses that involve low pointers and their related pointers. This reduces unnecessary checks on safe code and improves performance while still detecting potential memory bugs.

How does Iran's approach compare to the traditional AddressSanitizer (ASan)?

Iran's approach is more efficient than traditional ASan because it reduces redundant checks, focusing only on unsafe memory access sites, especially those related to low pointers. This results in a performance improvement of about 240% compared to ASan.

What performance improvements were observed with Iran?

Iran achieves a 240% improvement in performance compared to traditional ASan by reducing unnecessary memory checks. Additionally, it can remove 90% of redundant sanitizer tracks, leading to lower runtime overhead.

What did the evaluation of Iran demonstrate regarding its detection capabilities?

The evaluation showed that Iran has the same detection capabilities as traditional ASan, successfully detecting all 28 reproducible CVEs (Common Vulnerabilities and Exposures), indicating that it does not sacrifice detection for performance.

What are the practical implications of this research for Rust developers?

For Rust developers, this research offers an efficient way to detect memory bugs in 'unsafe' Rust code without incurring the heavy performance overhead typically associated with existing sanitizers. It enables safer and more performant use of Rust in memory-critical applications.