Memory-Safe Code Adoption Has Made Android Safer

The variety of memory-related vulnerabilities in Android has dropped sharply over the previous 5 years, because of Google’s use of a secure-by-design method that emphasizes using memory-safe languages like Rust for many new code.

Reminiscence questions of safety like buffer overflows and use-after-free bugs now account for simply 24% of all Android vulnerabilities, in comparison with 76% in 2019. Numbers thus far this 12 months recommend a complete of 36 Android memory-related vulnerabilities for all of 2024, or roughly half the quantity as final 12 months and a far cry from 223 flaws in 2019.

Safe-by Design Method Pays Off

In a Sept. 25 blog post, researchers from Google’s Android and safety groups credited the progress to Protected Coding, a secure-by-design method on the firm that prioritizes memory-safe languages like Rust for brand spanking new code growth. “Primarily based on what we have realized, it is turn into clear that we don’t must throw away or rewrite all our current memory-unsafe code,” the researchers wrote. “As an alternative, Android is specializing in making interoperability secure and handy as a main functionality in our reminiscence security journey.”

Memory safety vulnerabilities have historically accounted for, and proceed to account for, greater than 60% of all utility software program vulnerabilities. They’ve additionally been disproportionately extreme when in comparison with different flaws. For example, in 2022, memory-related bugs made up only 36% of all identified Android vulnerabilities however accounted for 86% of essentially the most extreme flaws within the working system and 78% of confirmed exploited Android bugs.

A lot of this has to do with how broadly used programming languages akin to C and C++ permit software program builders to immediately manipulate reminiscence, leaving the door open for errors to creep in. In distinction, memory-safe languages like Rust, Go, and C# characteristic computerized reminiscence administration and built-in security checks towards frequent memory-related bugs. Quite a few safety stakeholders together with the US Cybersecurity and Infrastructure Security Agency (CISA) and even the White House have raised issues over heightened safety publicity related to utilizing memory-unsafe languages and the substantial prices concerned in addressing them. Whereas the shift to memory-safe languages has been slowly gaining momentum, many anticipate it can take years and probably a long time to maneuver current code bases fully to memory-safe code.

A Gradual Transition

Google’s method to the issue has been to make use of memory-safe languages like Rust for brand spanking new Android options whereas leaving current code largely untouched besides to make bug fixes. The result’s that over the previous few years there was a gradual slowdown in new growth exercise involving memory-unsafe languages matched by a rise in memory-safe growth exercise, the 2 Google researchers stated.

Google started the transition with assist for Rust in Android 12 and has been regularly growing use of the programming language inside the Android Open Supply Undertaking. Android 13 marked the primary time that many of the new code within the working system was in a memory-safe language. On the time, Google emphasised that its purpose was to not convert all C and C++ code to Rust, however as an alternative to regularly transition to the brand new programming language over time.

In a weblog submit earlier this 12 months, members of Google’s safety engineering workforce famous that they noticed “no realistic path for an evolution of C++ right into a language with rigorous reminiscence security ensures.” However somewhat than strolling away from it unexpectedly, Google will proceed to spend money on instruments to enhance reminiscence security in C and C++ to assist the corporate’s current codebases written in these languages.

Considerably, Google discovered that memory-related bugs as a share of all Android vulnerabilities declined not simply due to the corporate’s rising use of a memory-safe language like Rust but in addition as a result of older vulnerabilities decayed with time. The researchers discovered that the variety of vulnerabilities in a given quantity of code — sometimes called vulnerability density — was decrease in five-year-old Android code in comparison with model new code.

“The issue is overwhelmingly with new code, necessitating a elementary change in how we develop code,” the researchers stated.