SOJOURNERS

Android Runs Better When Covered In Rust

“C/C++ should no longer be used to start new projects and that Rust should be deployed where a language without garbage collection is required.”

Mark Russinovich, Microsoft CTO

Google’s decision to use Rust for new code in Android in order to reduce memory-related flaws appears to be paying off. Memory safety vulnerabilities in Android have been more than halved — a milestone that coincides with Google’s switch from C and C++ to the memory-safe programming language, Rust.

Google has been integrating code written in the Rust programming language into its Android operating system since 2019 and its efforts have paid off in the form of fewer vulnerabilities.

Memory safety bugs – like out of bounds read and write or use after free – account for more than 65 percent of vulnerabilities of high or critical severity bugs in Chrome and Android, and the figures are similar in software from other vendors. These flaws degrade security and increase the cost of software development when not caught early.

But after four years in which Android has been collecting bits of Rust, that figure has declined.

“From 2019 to 2022 the annual number of memory safety vulnerabilities dropped from 223 down to 85,” said Android security engineer Jeffrey Vander Stoep. He says the decline coincides with efforts to move away from memory unsafe programming languages, by which he means C/C++ – a language that does not guarantee memory safety but can support it.

Starting with Android 12 last year, Rust became an Android platform language. And now in Android 13, says Vander Stoep, the majority of new code added to the release was written in a memory safe language – Rust, Java, or Kotlin.

With less memory-unsafe code entering Android, memory safety flaws have gone from 76 percent of Android vulnerabilities in 2019 to 35 percent in 2022 – the first year for which memory safety bugs do not represent the majority of vulnerabilities.

Other vulnerabilities have remained steady over time, appearing at a rate of about 20 per month over the past four years. Because memory safety flaws accounted for most of the critical issues, the vulnerabilities that have surfaced have proven to be less severe.

Google is not the only large tech company to recognize the benefits of memory safe code. Meta has voiced its appreciation of Rust. Several months ago, Microsoft CTO Mark Russinovich declared that C/C++ should no longer be used to start new projects and that Rust should be deployed where a language without garbage collection is required.

At the time, Bjarne Stroustrup, creator of C++, challenged Russinovich’s guidance by pointing out that type and memory safety can be had in ISO standard C++, enforced by a static analysis. As Stroustrup sees it, helping C++ evolve makes more sense than deprecating the language and leaving unsafe code untended.

Final Thoughts

Google continues to invest in tools to write safer C/C++ code, pointing to the Scudo hardened allocator, HWASAN, GWP-ASAN, and KFENCE on Android devices. Google has increased its use of fuzzing. But while such measures have contributed to the decline in memory safety bugs, most of the vulnerability reduction should be attributed to the transition toward memory safe languages like Rust.

Body Text

🅐🅚🅖

Interested in Management, Design or Technology Consulting, contact anil.kg.26@gmail.com
Get updates and news on our social channels!

LATEST POSTS

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.