Urgent Call for Memory-Safe Programming in Open Source Projects
The cybersecurity landscape is ever-evolving, with threats becoming more sophisticated by the day. In a concerted effort to fortify the software that underpins our digital world, the United States’ Cybersecurity and Infrastructure Security Agency (CISA) has once again emphasized the importance of adopting memory-safe programming languages. This plea comes in the wake of a revealing report indicating a significant prevalence of memory-unsafe code within widespread open-source projects.
In collaboration with the FBI, and partners from Canada and Australia, CISA unveiled findings that over half of the open-source projects examined contain code written in memory-unsafe languages. Alarmingly, 55% of the coding across these projects was pinpointed as memory-unsafe, with large-scale projects being the most affected. Moreover, even projects initially claimed to be developed in memory-safe languages were found to incorporate elements crafted with memory-unsafe code.
The “Exploring Memory Safety in Critical Open Source Projects” report underscores the need for software developers to devise concrete roadmaps toward incorporating memory-safety. Such plans should extend to addressing memory safety in external dependencies, which are often open-source software (OSS). With the notable push for migration from languages like C and C++ to memory-safe alternatives including Rust, C#, Go, Java, Python, and Swift, CISA aims to drastically reduce vulnerabilities that stem from improper memory management — such as buffer overflows and use-after-free errors.
Memory-safe languages offer a safety net by automatically detecting and preventing memory access errors, shifting the burden of memory management from developers to the compiler or interpreter. This critical layer of abstraction significantly narrows the window for introducing memory safety vulnerabilities into software.
The scrutiny brought to bear by the 172 open-source projects, analyzed from the Open Source Security Foundation (OpenSSF) Securing Critical Projects Working Group’s list, demonstrates that even software developed in memory-safe languages is not immune to memory safety flaws. The report details how the direct or indirect use of memory-unsafe languages, or disabling memory safety for low-level functionality, can introduce vulnerabilities in otherwise secure code. Acknowledging these limitations, CISA, and its partners advocate for the rigorous application of memory-safe programming practices, security-focused coding practices, and robust security testing.
Neatsun Ziv, CEO of OX Security, echoes these sentiments, acknowledging the challenges inherent in transitioning legacy systems, predominately built in C and C++, to modern, memory-safe frameworks. Such a transition, while beneficial for long-term security, poses significant logistical and financial challenges to organizations. Ziv suggests a pragmatic approach, prioritizing the migration of critical components and employing advanced code analysis tools and compilers to rectify unsafe coding practices efficiently.
This call to action for adopting memory-safe programming is a testament to the ongoing efforts by federal agencies, including CISA, to embed security into the fabric of software development from the ground up. By championing the transition to memory-safe languages, these agencies aim to significantly reduce the cyber attack surface, effectively eliminating entire classes of software vulnerabilities.
As this initiative gains momentum, it is clear that the shift towards memory-safe programming is not merely a technical upgrade but a fundamental rethinking of software development practices to prioritize security. The collective action of developers, government, and industry stakeholders will be pivotal in this transformative journey towards a more secure digital ecosystem.
