Help in ideation for a project

Hi, I have using been Rust for a while and I love it!

So now, I have this course project in computer system security and I was tasked to (for now) find a topic i can research in for Rust language vulnerabilities. Well as memory-safe rust is, along with many other defenses the rust-book mentioned, I am lost as to what I can think about and do a project into.

Does anyone have any potential ideas or know-abouts on where I can look around for a topic?
(This is purely for academic purposes btw and would love to contribute if i actually end up doing something useful.)

Hello, @AnirudhG07

That's a great question, and it's a common one for security researchers new to Rust. While Rust is memory-safe, it's not without its vulnerabilities. Your project should focus on the areas where Rust's safety guarantees can be bypassed or where its unique features introduce new types of security concerns.

Unsafe Rust also exist using unsafe {} block

Any Language Have Vulnerability So You need Audit Your Code and Dependencies.

I'd probably check the list of past and current CVE's filed for Rust here: https://www.cvedetails.com/vulnerability-list/vendor_id-19029/Rust-lang.html

Or other resources on the wider ecosystem you can find..

And in sandbox containers like Docker etc. exploit those vulnerabilities and compare the same exploits with the fixed versions.

This will also act as an audit of the fixes. Did any of the fixes regress etc.. Did they!!?? :hot_face:

This way it might be also possible to generate statistical data on the evolution of vulnerabilities in Rust itself and important crates.

2 Likes

Hi @relunsec, thanks for that! Just asking if you happen to know any such security concerns? Otherwise its back to searching for something and reading lots of papers to find some possible concrete idea. That would be really helpful!

Thanks.

Get the grading system for it and tailor answer.
edit: Forget that. Just remembered after posting that is too bleak for me. Pick something you like. If skilled create a fantastic project that gives low number in marking. Then hack the system and change your own.

Are you seeking something specific of creating something broad? Security covers many things, such as from where you get the software. Maybe you want what the language does not protect against. (eg TOCTOU)

This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.