RustGo: Fairly Directed Greybox Fuzzing for Enforcing Rust Memory Safety

• URL: http://arxiv.org/abs/2608.05870v1
• Date: Thu, 06 Aug 2026 10:48:37 GMT
• Title: RustGo: Fairly Directed Greybox Fuzzing for Enforcing Rust Memory Safety
• Abstract summary: Rust is a popular systems programming language that provides strong memory safety and introduces low-performance overhead.<n> Rust guarantees memory safety through strict security policies, such as ownership, but memory bugs can still occur in unsafe-related Rust codes.<n>We propose RustGo, the new Rust-directed greybox fuzzer that effectively and fairly focuses on code regions potentially containing memory bugs.
• Score: 5.500253242856999
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Rust is a popular systems programming language that provides strong memory safety and introduces low-performance overhead. While Rust guarantees memory safety through strict security policies, such as ownership, memory bugs can still occur in unsafe-related Rust codes where these policies are not fully enforced. Although such unsafe Rust code accounts for only a small portion of the entire code (e.g., 10%), existing approaches fuzz the entire code-including safe Rust, whose memory safety is already enforced by the Rust compiler-resulting in inefficient use of fuzzing resources. In this paper, we propose RustGo, the new Rust-directed greybox fuzzer that effectively and fairly focuses on code regions potentially containing memory bugs. For this, RustGo automatically identifies potential memory bug targets and accurately prunes the paths irrelevant to each target by leveraging Rust-specific static analysis. For each identified target, RustGo includes a new fuzzing approach that maintains an independent state and applies dynamic pruning to maximize balanced and focused fuzzing. We evaluate RustGo on various real-world Rust applications. On average, RustGo prunes 78.49% of irrelevant paths, reaches targets x 2.09 to x 5.08 faster than existing fuzzers, and identifies 13 unknown bugs (six assigned RUSTSEC IDs and one assigned CVE ID).

Related papers

• Scaling Verification of Cryptographic Software with Aeneas, Rust, and Lean [36.30712689467804]
  We develop a new methodology for verifying cryptographic software written in Rust.<n> Rust's ownership discipline enables Aeneas to extract a pure model of this code in Lean.<n>Agents autonomously write formal proofs, which are independently verified by the Lean kernel.
  arXiv  Detail & Related papers  (2026-09-14T14:32:51Z)
• Generative Compilation: On-the-Fly Compiler Feedback as AI Generates Code [43.07697210931911]
  We introduce generative compilation, the first approach to obtaining compiler feedback on partial programs during generation.<n>We show that generative compilation reduces non-compiling outputs and improves functional correctness, relative to standard post-generation feedback.
  arXiv  Detail & Related papers  (2026-07-15T15:00:22Z)
• Enhancing Software Engineering Through Closed-Loop Memory Optimization [50.418699819003486]
  We introduce ours, a closed-loop framework for memory augmentation in software engineering (SE) agents.<n>ours grounds memory utility in textitvalidated downstream impact, establishing utility as a task-agnostic textbf benchmark and an annotation-free textbfoptimization signal.<n>Results demonstrate that ours consistently improves SE agents across settings, achieving absolute gains of up to $uparrow5.25%$ in success rate and $uparrow4.63%$ in resolve efficiency.
  arXiv  Detail & Related papers  (2026-06-04T03:17:21Z)
• MISRust: Mapping MISRA-C++ Coding Guidelines to the Rust Programming Language [37.20818475839222]
  This paper systematically examines each of the 179 MISRA C++ 2023 coding guidelines.<n>We find that 47.75% of the 111 as-is applicable MISRA rules are automatically enforced by Rust's language design.<n>We find that 69 guidelines are still relevant and still require either direct application or adaptation for Rust.
  arXiv  Detail & Related papers  (2026-05-22T10:52:52Z)
• SafeSeek: Universal Attribution of Safety Circuits in Language Models [49.59795225914787]
  We propose ourmethod, a unified safety interpretability framework.<n>Our method identifies functionally complete safety circuits in Large Language Models.<n>We validate ourmethod in two key scenarios in LLM safety.
  arXiv  Detail & Related papers  (2026-03-24T14:32:53Z)
• SafeFFI: Efficient Sanitization at the Boundary Between Safe and Unsafe Code in Rust and Mixed-Language Applications [5.578413517654703]
  Unsafe Rust code is necessary for interoperability with C/C++ libraries and implementing low-level data structures.<n>Sanitizers can catch such memory errors at runtime, but introduce many unnecessary checks even for memory accesses guaranteed safe by the Rust type system.<n>We introduce SafeFFI, a system for optimizing memory safety instrumentation in Rust binaries.
  arXiv  Detail & Related papers  (2025-10-23T16:02:45Z)
• Securing Mixed Rust with Hardware Capabilities [12.52089113918087]
  CapsLock is a security enforcement mechanism that can run at the level of machine code and detect Rust principle violations at run-time in mixed code.<n> CapsLock is kept simple enough to be implemented into recent capability-based hardware abstractions.
  arXiv  Detail & Related papers  (2025-07-04T07:12:43Z)
• Targeted Fuzzing for Unsafe Rust Code: Leveraging Selective Instrumentation [3.6968220664227633]
  Rust is a promising programming language that focuses on usability and security.<n>It allows programmers to write unsafe code which is not subject to the strict Rust security policy.<n>We present an automated approach to detect unsafe and safe code components to decide which parts of the program a fuzzer should focus on.
  arXiv  Detail & Related papers  (2025-05-05T08:48:42Z)
• CRUST-Bench: A Comprehensive Benchmark for C-to-safe-Rust Transpilation [51.18863297461463]
  CRUST-Bench is a dataset of 100 C repositories, each paired with manually-written interfaces in safe Rust as well as test cases.<n>We evaluate state-of-the-art large language models (LLMs) on this task and find that safe and idiomatic Rust generation is still a challenging problem.<n>The best performing model, OpenAI o1, is able to solve only 15 tasks in a single-shot setting.
  arXiv  Detail & Related papers  (2025-04-21T17:33:33Z)
• C2SaferRust: Transforming C Projects into Safer Rust with NeuroSymbolic Techniques [16.111888466557144]
  We present C2SaferRust, a novel approach to translate C to Rust.<n>We first use C2Rust to convert C code to non-idiomatic, unsafe Rust.<n>We decompose the unsafe Rust code into slices that can be individually translated to safer Rust by an LLM.<n>After processing each slice, we run end-to-end test cases to verify that the code still functions as expected.
  arXiv  Detail & Related papers  (2025-01-24T05:53:07Z)
• Unsafe's Betrayal: Abusing Unsafe Rust in Binary Reverse Engineering toward Finding Memory-safety Bugs via Machine Learning [20.68333298047064]
  Rust provides memory-safe mechanisms to avoid memory-safety bugs in programming. Unsafe code that enhances the usability of Rust provides clear spots for finding memory-safety bugs. We claim that these unsafe spots can still be identifiable in Rust binary code via machine learning.
  arXiv  Detail & Related papers  (2022-10-31T19:32:18Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.