Technical Summary: RustGo

Problem Statement

Rust guarantees memory safety through strict compile-time policies (ownership, borrowing, lifetimes), yet memory bugs persist in unsafe regions where these policies are bypassed. While unsafe code constitutes a small fraction of typical Rust programs (approximately 10%), existing fuzzing approaches treat the entire codebase as a potential source of bugs. This results in inefficient resource allocation, as fuzzers waste effort on memory-safe regions that the Rust compiler already guarantees are secure.

Furthermore, existing Directed Greybox Fuzzing (DGF) solutions, originally designed for C/C++, face significant challenges when applied to Rust:

1. Target Identification: Traditional methods rely on manual selection or simple criteria (e.g., sanitizer locations) and fail to automatically identify memory-bug-prone targets specific to Rust's unique architecture, such as raw pointer dereferences in safe code aliased to unsafe pointers.
2. Path Pruning: Rust's standard library is statically linked and monomorphized, creating a complex, unified binary. Existing reachability analyses often over-approximate, failing to prune irrelevant paths because they cannot distinguish between user code and standard library logic effectively.
3. Fairness in Multi-Target Fuzzing: Existing multi-target DGFs often prioritize "closer" targets, leading to starvation of distant but vulnerable targets. Shared fuzzing states (single input queue, single coverage bitmap) make it difficult to allocate energy fairly across multiple distinct targets.

Methodology

The paper proposes RustGo, a Rust-directed greybox fuzzer designed to automatically identify, optimize, and fairly fuzz memory-bug-prone regions. RustGo operates through three core components:

1. Target Identification and Optimization

RustGo employs a multi-stage static analysis to identify vulnerable targets:

• MIR and LLVM IR Analysis: It performs type-matching analysis at the Mid-level Intermediate Representation (MIR) level to identify raw pointer operations, which are not preserved in LLVM IR. It then uses Value Flow Graph (VFG)-based taint analysis at the LLVM IR level to track pointer propagation and identify aliasing sites.
• Standard Library Filtering: To avoid false positives caused by context-insensitive analysis of the monomorphized standard library, RustGo annotates standard library functions. It utilizes Inter-procedural Control Flow Graph (ICFG) edges to propagate taint across library boundaries without traversing internal library logic, effectively filtering out unreachable paths.
• Post-Dominance Optimization: To reduce the number of targets and prevent the fuzzer from degrading into a generic coverage-guided fuzzer, RustGo performs inter-procedural post-dominance analysis. If a target $t_i$ is post-dominated by $t_j$ (meaning all paths to $t_i$ must pass through $t_j$), $t_i$ is merged into $t_j$. This reduces redundant targets by consolidating them into representative locations.

2. Target-Specific Path Pruning

Once targets are identified, RustGo eliminates irrelevant paths to maximize fuzzing efficiency:

• Call-Site Remapping: Targets located within the standard library are remapped to their corresponding invocation sites in user code to ensure precise reachability analysis.
• Precondition-Aware Pruning:
  • For spatial bugs (raw pointer dereferences), no pruning is applied as these can occur without specific preconditions.
  • For temporal bugs (e.g., Use-After-Free), RustGo leverages taint analysis results to verify if a path contains the necessary memory operation sequence (e.g., alloc $\to$ free $\to$ dereference). Paths lacking these sequences are pruned.
  • Async/Await Handling: To prevent false negatives in concurrent code, RustGo conservatively disables pruning for functions involving async/await and raw pointer aliasing.

3. Dynamic Fair Toggling Fuzzing

To ensure equitable testing across multiple targets without interference, RustGo introduces a dynamic toggling mechanism:

• Multi-Queue and Multi-Coverage: Unlike traditional fuzzers that use a single input queue and global coverage bitmap, RustGo maintains independent input queues and coverage bitmaps for each target.
• Dynamic Toggle: The fuzzer switches between targets in a round-robin fashion. When a target is active, the system updates a shared "Toggle Shared Memory" (TSM) to dynamically enable only the basic blocks relevant to that specific target. This allows the fuzzer to prune irrelevant paths in real-time for the current target while maintaining independent fuzzing states, ensuring no target is starved of resources.

Key Contributions

1. RustGo Framework: A new directed greybox fuzzer tailored specifically for Rust, capable of automatically identifying and optimizing memory-bug-prone targets using Rust-specific static analysis (MIR/LLVM IR cross-analysis, taint tracking, and post-dominance).
2. Target-Specific Pruning: A novel pruning strategy that handles Rust's complex standard library structure and monomorphization, achieving high precision in eliminating irrelevant paths.
3. Fair Multi-Target Fuzzing: A dynamic toggling approach with multi-queue and multi-coverage schemes that ensures balanced energy allocation across multiple targets, preventing the bias toward easily reachable targets common in existing DGFs.
4. Evaluation and Discovery: Comprehensive evaluation on real-world Rust applications, demonstrating significant performance improvements over state-of-the-art fuzzers and the discovery of 13 previously unknown memory bugs.

Results

The authors evaluated RustGo on a custom benchmark of 13 real-world Rust applications and the deepSURF benchmark (26 real-world bugs).

• Target Optimization: RustGo reduced the number of initial targets by an average of 84.13% through post-dominance consolidation.
• Path Pruning: RustGo pruned an average of 78.49% of irrelevant paths per target, significantly outperforming baseline approaches (e.g., RG-base at 51.11%).
• Speedup: RustGo reached targets 2.09x to 5.08x faster than existing DGFs (including AFLGo, WindRanger, FishFuzz, and PanicKiller) and 2.85x to 3.45x faster than coverage-guided fuzzers (AFL, AFL++).
• Vulnerability Discovery: RustGo identified 13 previously unknown memory bugs in real-world Rust projects. Of these, 10 were confirmed, 8 were patched, 6 received RUSTSEC IDs, and 1 received a CVE ID.
• Comparison with Fuzz Drivers: When compared against fuzz driver generators (RPG, RUG, deepSURF), RustGo successfully detected all 13 new bugs, whereas the generators failed to detect the majority due to difficulties in constructing complex argument types and execution contexts.

Significance

The paper claims that RustGo addresses the critical inefficiency of applying C/C++-centric fuzzing strategies to Rust. By leveraging Rust's unique language features (ownership, monomorphization, and the distinction between safe and unsafe code), RustGo achieves a "fair" and "directed" fuzzing process that avoids wasting resources on memory-safe code. The results demonstrate that targeted, Rust-aware fuzzing is not only more efficient but also more effective at uncovering deep memory safety vulnerabilities than both generic coverage-guided fuzzing and existing directed approaches. The discovery of 13 new bugs, including those assigned CVE and RUSTSEC IDs, validates the practical utility of the framework in enhancing the security of the Rust ecosystem.