SaTC: CORE: Small: Collaborative: Understanding and Detecting Memory Bugs in Rust

Rust是一种为系统软件开发而设计的年轻编程语言。它的主要设计目标是实现与其竞争语言C一样好的运行时性能，同时使用线性类型系统和严格的编译时检查提供更好的内存和线程安全性。Rust在安全关键软件（如操作系统、浏览器和区块链系统）的开发人员中越来越受欢迎。然而，实践者和研究人员对真实Rust程序中内存bug的状态知之甚少。例如，Rust编译时检查是否消除了所有内存错误？如果不是，Rust中的内存错误是否表现出某些可检测的模式？本项目通过设计识别和消除内存漏洞的技术来寻求这些问题的答案。特别是，它旨在更好地理解Rust程序员所犯的常见错误，并构建新的技术来捕获Rust编译时检查遗漏的内存错误。其结果将影响Rust的发展，指导开发者如何安全地编程Rust，并提高Rust生态系统的安全性。Rust安全机制是健全的，但有时过于严格，阻碍了对底层资源的灵活控制。为了缓解这个问题，Rust允许开发人员使用不安全的代码绕过编译器的检查。可以将函数声明为不安全的。安全函数中的一段代码可能是不安全的，称为内部不安全，其中不安全代码在内部封装并在外部被视为安全的。不幸的是，不安全代码和内部不安全代码会导致内存错误，因为它们绕过Rust安全检查。这个项目旨在更好地理解Rust内存错误，并构建新的静态/动态工具来对抗Rust内存错误。该项目包含三个组成部分：(1)Rust内存错误的全面分类，(2)识别内部不安全函数中内存错误的新颖静态技术，以及(3)Rust中安全/不安全信息增强的新型模糊测试技术。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Rust is a young programming language designed for systems software development. Its main design goal is to achieve runtime performance as good as its competitor language, C, while offering better memory and thread safety using a linear type system and strict compile-time checking. Rust has become increasingly popular among developers of safety-critical software, such as operating systems, browsers, and block-chain systems. However, both practitioners and researchers know little about the status of memory bugs in real-world Rust programs. For example, do Rust compile-time checks eliminate all memory bugs? If not, do memory bugs in Rust exhibit certain detectable patterns? This project seeks answers to these questions by devising techniques to identify and eliminate the memory bugs? In particular, it aims to achieve a better understanding of common mistakes made by Rust programmers and build novel techniques to catch memory bugs missed by Rust compile-time checks. The outcome will influence how Rust evolves, guide how developers program Rust safely, and improve the safety of the Rust ecosystem. Rust safety mechanisms are sound, but sometimes they are too strict and prevent flexible control over low-level resources. To mitigate this problem, Rust allows developers to bypass its compiler checks using unsafe code. A function can be declared as unsafe. A piece of code inside a safe function can be unsafe, known as interior unsafe, where the unsafe code is encapsulated internally and treated as safe externally. Unfortunately, unsafe code and interior unsafe code can lead to memory bugs since they bypass Rust safety checks. This project aims to better understand Rust memory bugs and build novel static/dynamic tools to combat Rust memory bugs. This project contains three components: (1) a comprehensive taxonomy of Rust memory bugs, (2) novel static techniques to identify memory bugs in interior unsafe functions, and (3) novel fuzzing techniques enhanced by the safe/unsafe information in Rust.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.