Google: After using Rust, we slashed Android memory safety vulnerabilities

Google’s final decision to use Rust for new code in Android in order to lower memory-relevant flaws seems to be having to pay off. Memory safety vulnerabilities in Android have been much more than halved — a milestone that coincides with Google’s swap from C and C++ to the memory-risk-free programming language, Rust.

This is the initially year that memory security vulnerabilities are not the biggest class of stability flaws, and will come a yr right after Google built Rust the default for new code in the Android Open Resource Task (AOSP).

Other memory-secure languages Google has employed for Android involve Java and Java-compatible Kotlin. C and C++ are even now dominant languages in AOSP, but Android 13 is the to start with version in which most of the new code is from memory-secure languages. Following Google adopted it for AOSP in April 2021, Rust now accounts for about 21{18875d16fb0f706a77d6d07e16021550e0abfa6771e72d372d5d32476b7d07ec} of new code. The Linux kernel venture this year adopted Rust as the new formal 2nd language to C. 

Android version 10 from 2019 experienced 223 memory protection bugs, when Android 13 has 85 recognized memory protection difficulties. 

In excess of that time period, memory safety vulnerabilities have dropped from 76{18875d16fb0f706a77d6d07e16021550e0abfa6771e72d372d5d32476b7d07ec} down to 35{18875d16fb0f706a77d6d07e16021550e0abfa6771e72d372d5d32476b7d07ec} of Android’s whole vulnerabilities, notes Android protection software program engineer Jeffrey Vander Stoep. With this drop in memory basic safety vulnerabilities, Google is also observing a drop in important and remotely exploitable flaws.   

Vander Stoep notes that this change was not driven by “heroics” — just builders making use of the greatest tools for the occupation. The Android group programs to stage up usage of Rust, though there are no strategies to get rid of C and C++ for its devices programming. 

“If I had to establish a one characteristic that helps make this probable, I would say ‘humility’. There’s a willingness inside all degrees of the Android staff to say ‘How can we do superior?’ along with the fortitude to adhere to by way of and make improvements, which include systemic alterations,” he mentioned in a tweet. 

“Humility wants to go the two strategies though. Rust doesn’t address all issues, and there are areas wherever C/C++ will go on to be the most useful solution for development, at the very least for a even though. Which is Alright.

“We’ll get the job done on lowering that above time even though continuing to scale up our Rust utilization and continuing to spend-in and deploy advancements to C/C++.”

Correlation will not equate to causation, Vander Stoep notes, but the percentage of memory basic safety safety bugs — which dominate significant severity bugs — does carefully match the languages utilised for new code.   

Security resources like fuzzing have also manufactured a massive effects on memory protection bugs, claims Google. 

“We carry on to invest in resources to strengthen the security of our C/C++. More than the past several releases we have released the Scudo hardened allocator, HWASAN, GWP-ASAN, and KFENCE on output Android devices. We have also increased our fuzzing protection on our existing code foundation. Vulnerabilities identified utilizing these resources contributed each to avoidance of vulnerabilities in new code as nicely as vulnerabilities located in old code that are included in the above evaluation. These are important tools, and critically essential for our C/C++ code. However, these by itself do not account for the significant shift in vulnerabilities that we are seeing, and other tasks that have deployed these technologies have not witnessed a important change in their vulnerability composition. We feel Android’s ongoing change from memory-unsafe to memory-safe and sound languages is a big issue,” writes Vander Stoep.

He goes on to note that in Android 13 there are 1.5 million overall traces of Rust code, representing about 21{18875d16fb0f706a77d6d07e16021550e0abfa6771e72d372d5d32476b7d07ec} of all new code. To day, Google has found not a solitary memory security vulnerability in Android’s Rust code.

“It demonstrates that Rust is satisfying its meant objective of avoiding Android’s most prevalent source of vulnerabilities. Historical vulnerability density is higher than 1/kLOC (1 vulnerability for each thousand lines of code) in quite a few of Android’s C/C++ elements (e.g. media, Bluetooth, NFC, and so on). Primarily based on this historical vulnerability density, it truly is likely that employing Rust has presently prevented hundreds of vulnerabilities from achieving manufacturing,” Vander Stoep notes. 

Google sees the go away from C/C++ as challenging, but is urgent ahead with the challenge for Android. Having said that, it is not moving to Rust for Chrome. 

For Android, while, Google is implementing userspace components abstraction layers (HALs) in Rust and including assist for Rust in Trusted Purposes. It has also migrated digital machine firmware in the Android Virtualization Framework to Rust. And with guidance for Rust in the Linux kernel version 6.1, Google is bringing memory-safety to the kernel, starting up with kernel motorists.