Rust와 C/C++간 안전한 상호작용에 관한 연구의 맹점과 개선 모델 연구
Limitations and Future Work Suggetion on Safe Interaction Model between Rust and C/C++
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
소프트웨어 개발이 가속화되고 프로그램들이 기하급수적으로 복잡해짐에 따라 취약점을 줄이고, 관리하는 비용도 같이 증가하였다. 이러한 흐름에서, 기존의 C/C++ 와 같이 비교적 취약점을 내포하기 쉬운 언어를 대체하고 소프트웨어의 안정성을 높이기 위해서 제시된 것이 바로 Memory Safety를 보장하는 Rust 프로그래밍 언어이다. 하지만, 구식 언어들과의 호환성 및 개발의 편리함을 높이기 위해 C/C++로 작성된 라이브러리를 Rust에서도 사용할 수 있도록 지원하고 있는데, 이러한 다중 언어 환경에서는 Rust 또한 안전하지 않다. C/C++에서 발생한 메모리 오염이 Rust 내에서 Null-pointer 역참조, Use-After-Free 및 Buffer-overflow 문제 등을 발생시킬 수 있는 원인이 된다. 이를 해결하기 위해 여러 Rust-C/C++ 격리 연구가 진행되었으나, 아직 기초 단계이다. 본 논문에서는 선행 연구들을 분석하여 공통적으로 간과된 맹점들을 실제 코드 분석과 함께 소개하고, 이를 바탕으로 Rust와 C/C++간의 안전한 상호작용 모델 연구의 올바른 방향을 제시한다.
Abstract
As software development progresses and programs become increasingly complex, the cost of reducing and managing software vulnerabilities has also increased. To address this issue, the Rust programming language, which guarantees Memory Safety, has been suggested as an alternative for more error-prone languages such as traditional C/C++. However, Rust also supports the use of libraries written in C/C++ to enhance compatibility with older languages and avoid redundant development, compromising its original guarantees. For example, memory corruption happened in C/C++ can lead to exploits such as buffer overflow, Use-After-Free and null-pointer dereferecing. To tackle this problem, recent studies have been conducted to secure interactino between Rust and C/C++ by isolation. This paper uncovers areas that have not been fully explored in previous studies, following limitation analysis on each. Finally, this paper suggests the future direction of research on safe interaction between Rust and C/C++.
참고문헌 (18)
- N. D. Matsakis, "The rust language", ACM SIGAdaAda Letters, 34(3), pp.103~104 (2014)
- J. Meyerson, "The go programming language", IEEE software, 31(5), pp.104~104 (2014)
- "Kotlin Language Documentation"[URL]
- "Sustainability with Rust | AWS Open Source Blog"[URL]
- "Discord"[URL]
- "Rust Introduction for v6.1-Rc1 - Kees Cook"[URL]
- Jung, Ralf, "RustBelt : Securing the foundations of the Rust programming language", Proceedings of the ACM on Programming Languages2, pp.1~34 (2018), POPL
- "Servo"[URL]
- "Mozilla Spidermonkey JavaScript Engine"[URL]
- M. Papaevripides, "Exploiting mixed binaries", ACM Transactions on Privacy and Security(TOPS), 24(2), pp.1~29 (2021)
- Mergendahl, Samuel, "Cross-language attacks", Proceedings 2022 Network and Distributed System Security Symposium. NDSS, 22, pp.1~17 (2022)
- Paul Kirth, "PKRU-safe : automatically locking down the heap between safe and unsafe languages. In Proceedings of the Seventeenth European Conference on Computer Systems", Proceedings of the Seventeenth European Conference on Computer Systems, pp.132~148 (2022), Association for Computing Machinery
- Rivera, Elijah, "Keeping safe rust safe with galeed", Annual Computer Security Applications Conference, pp.824~836 (2021)
- Benjamin Lamowski, "Sandcrust: Automatic Sandboxing of Unsafe Components in Rust", Proceedings of the 9th Workshop on Programming Languages and Operating Systems, pp.51~57 (2017), Association for Computing Machinery
- Hussain M. J. Almohri, "Fidelius Charm : Isolating Unsafe Rust Code", Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy (CODASPY '18), pp.248~255 (2018), Association for Computing Machinery
- "Intel Memory Protection Keys" (2015)[URL]
- R. Joseph Connor, "PKU Pitfalls : Attacks on PKU-based Memory Isolation Systems", 29th USENIX Security Symposium(USENIX Security 20), USENIX Association, pp, pp.1409~1426 (2020), USENIX Association
- Landi, William, "Pointer-induced aliasing : A problem classification", Proceedings of the 18th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp.93~103 (1991)